Shift left, organisation-wide
Every developer's agent is checked the same way, before the commit, on their own machine — so fewer problems reach CI, review and production.
Enterprise
Enterprise AI coding agent governance your security review can check
Enterprise AI coding agent governance starts where the code is written. Cotterpin shifts quality and security left, onto each developer's machine and into the agent session, so AI slop is stopped before the commit — with one policy for every team, and evidence for every decision.
What it gives an engineering organisation
One policy for everyone
On Team and Enterprise, a shared, admin-owned gate policy applies across repositories. Agents can't switch the gates off, and an override needs a person's signed approval and a reason.
Evidence for every decision
Every verdict has a receipt bound to the exact inputs it checked, and every decision on an agent's action lands in an action log in the repository's git folder.
Your code stays with you
Cotterpin never receives your source, diffs or prompts. Only the model provider your developers already use sees the code, under your own account.
Any agent, one rule set
Antigravity,Claude, Codex and Grok share the same guard rules, so teams can use different agents without different standards.
A measured return
cotterpin report shows what was caught and the cost per landed change, computed locally from the prices you set. Time and money saved
Controls by plan
| Control | Pro | Team | Enterprise |
|---|---|---|---|
| Destructive agent actions approved with your password, or Touch ID where it is enabled for sudo (root-signed) | ✓ | ✓ | ✓ |
| Single sign-on via OIDC — Okta, Entra ID, Google Workspace, GitHub | – | ✓ | ✓ |
| Shared, admin-owned gate policy | – | ✓ | ✓ |
| Seat management | – | ✓ | ✓ |
| SAML single sign-on & SCIM user provisioning | – | – | ✓ |
| Agents run as a confined, separate OS identity | – | – | ✓ |
| Audit-trail export to your SIEM | – | – | ✓ |
| Air-gapped updates, MDM deployment | – | – | ✓ |
| Approvals bound to a hardware key or your SSO — hardened mode, being built | Being built | Being built | Being built |
Answers for your security review
| Question | Answer |
|---|---|
| Does our source code leave our machines? | No. Cotterpin has no cloud that sees source, diffs or prompts. Only the model provider you already use sees code, under your account. Security overview |
| What does Cotterpin itself receive? | What the licence service needs, set out in the Privacy Policy. Telemetry is off unless you turn it on. |
| Who processes data for you? | Listed on the Sub-processors page; Team and Enterprise customers get our Data Processing Addendum. |
| How long is data kept? | Set out in the Data Retention Policy. |
| Breach notification? | Set out in the GDPR Statement and the DPA. |
| Are releases verifiable? | Releases and licences are signed with keys held in AWS KMS, and the public keys are pinned in every build. Each release ships with an SBOM (CycloneDX). Check one yourself, offline, with cotterpin verify --release. |
| Can an agent approve its own actions? | No. Approvals are signed by a root-owned signer after the operating system confirms the person. On a developer's own machine this is a guardrail for agents; hardened mode is the boundary. The two modes |
| How are vulnerabilities reported? | Through our Security and Responsible Disclosure Policy and security.txt. |
| Certifications? | SOC 2 Type II and ISO/IEC 42001 are planned, not yet audited or certified. SLSA build provenance is planned. Our EU Cyber Resilience Act vulnerability-reporting process is published. |
| Who are you? | Cotterpin Technologies Ltd, registered in England and Wales, company number 17498532, registered office 18 Massingberd Way, London, SW17 6AB; ICO registration ZC266082. About us |
How a pilot works
- Pick a teamA few developers and a repository or two
- Install freeEach installs Cotterpin, free, no card, no sign-up
- WatchWatch reports what the gates would have caught, on your own code
- Measure
cotterpin reporton your own code - ReviewYour security team works through this page
- DecideTeam, or an Enterprise site licence
- Roll outShared policy and single sign-on
Talk to us about your organisation.
Or start a team pilot today: every developer starts on Watch, free with no time limit, no card.