Your code never leaves your machine.
To keep two agents from colliding, Coordigent needs to know which files each agent is touching and what it intends to do. It does not need the files themselves, so it never asks for them. Everything below is written so a security reviewer can check it against the product.
What Coordigent sees
- File paths and change intent
- An agent registers the paths it is editing and a one-line task description, so teammates’ agents are warned before they overlap.
- Agent-to-agent messages
- Short handoffs your agents exchange, such as “taking session.ts, you take refresh.ts”. Written by agents, visible to your team.
- Session metadata
- Which agent, which repository name, which teammate, and when.
- Account and billing
- Email, workspace and payment status. Card data is handled by Stripe and never touches our servers.
Every item here is something your team can also see in the session view.
What it never sees
- Source code and diffs
- Coordigent does not read, upload or store file contents. The daemon publishes paths, not bytes.
- Your prompts and completions
- What you say to your agent stays between you and your agent’s provider. We are not in that request path.
- Your model API keys
- Anthropic, OpenAI or Cursor keys are never sent to us. The only key involved is the Coordigent key for your workspace.
- Secrets and gitignored files
- Paths matching your repository’s ignore rules are excluded from the registry by default.
It is advisory by default: it warns an agent and its human, it never rewrites work or forces a merge.
How it’s built
- Storage
- Managed PostgreSQL, US, encrypted at rest and in transit
- Authentication
- Workspace-scoped bearer key, revocable any time
- Isolation
- One workspace never sees another’s registry or messages
- Retention
- Registry clears on session end; history deletable per workspace
- Self-hosting
- Single container plus a Postgres connection string
- Auditable client
- The daemon and MCP server on your machines are published
Works inside a single-model policy. Coordigent connects to whichever agent your company allows and adds awareness of teammates, not a second model. Nothing routes through a model you have not approved.
Answer your questionnaire
Send your vendor security questionnaire and the founders return it within five business days.
Send a questionnaireWalk through the code
Get on a call with your security team and we show what the daemon sends, packet by packet, against the source.
Book a walkthroughReport a vulnerability
We acknowledge within one business day and tell you when it is fixed.
Report to hi@coordigent.com