Security you can check, not a badge.
Coadie keeps each company’s material private by default, signs people in with two-step codes or your own single sign-on, and records what administrators change. We have no SOC 2 or ISO 27001 certificate yet, and we say so rather than imply one.
How do people sign in?
Signing in takes two steps: a code from an authenticator app, or your company’s single sign-on. Companies on Enterprise can use single sign-on through their own identity provider, with SAML or OpenID Connect (OIDC), and can switch company passwords off entirely.
- Named licences. On Enterprise, a licence belongs to one named person, matched on their email address. An administrator lists who holds one.
- Guessing is stopped. After 10 wrong guesses in five minutes, that email address is paused for five minutes.
- Secrets are protected. Passwords are stored scrambled so they cannot be read back, and connected keys are encrypted.
- Admin changes are recorded. Every change an administrator makes is kept on a record.
Who can see our content?
Only people inside your company who have access. What you upload belongs to your company alone; one company can never see another company’s material, and every page and every search goes through the same single check. What a person makes is private until they share it.
The only people outside your company who see your material are the readers you send a link to, and the outside services named on the privacy page, which see only what they need to do their job.
What happens to the files we upload?
When you upload a deck, Coadie keeps its words, shapes and pictures so you can build from them, then deletes the original file. Files marked Draft, Confidential or Do not use are kept out of new decks automatically.
To label, search, write and lay out your work, the words and pictures of your files, your briefs and what you type to the assistant are sent to an AI provider. The privacy page names them. Coadie’s activity log records that an AI request happened and what it cost, never what was said, and a company can connect its own AI account instead.
What do we have, and what don’t we have yet?
| Question | Today |
|---|---|
| Single sign-on (SAML, OIDC) | Yes, on Enterprise |
| Two-step sign-in | Yes: authenticator-app codes, or single sign-on |
| Company passwords switched off | Yes, when single sign-on is on |
| Administrator change record | Yes |
| Data download and deletion | Yes: people download their own details; administrators delete people; readers can be forgotten |
| Retention | Deleted items wait 30 days in the Trash; nightly backups keep a copy 14 more days; AI activity, notices and sign-in records clear after 12 months |
| SOC 2 or ISO 27001 | Not yet |
| Penetration test | Not yet |
If a certificate or a test report matters for your evaluation, ask us directly and we will tell you exactly where things stand.
Security questions.
Does Coadie support single sign-on?
Yes. Enterprise supports single sign-on through your identity provider with SAML or OpenID Connect, and company passwords can be switched off.
Is Coadie SOC 2 certified?
Not yet, and no penetration test has been carried out. We would rather say so plainly than imply a certificate we have not earned.
Can another company ever see our slides?
No. Every page and every search goes through the same check, and one company can never see another company’s material.
Is our material sent to AI providers?
Yes, only to do the work you asked for: labelling, searching, writing and laying out. Coadie records that a request happened and what it cost, never what was said, and a company can connect its own AI account instead.
Do customers who read a shared deck know they are tracked?
Yes. A shared deck opens with a short card saying exactly what is recorded, and the reader can skip giving their name.
See it on your own material.
Bring a handful of your decks. We’ll set up your workspace and build a first deck from them, with every line traced.