Enterprise.The people who write aren’t the people who approve.

Eight built-in roles keep duties apart: editors write, approvers approve and publish, billing managers handle spend. Build your own roles from the same permissions, enforced on the server.

Talk to Us Get Started
Roles · eight built in, plus your ownEnforced on the server

A record no one can rewrite.Including you.

Approvals, publishing, role changes, distribution orders and every API key's actions are written to the audit log in the same step as the change itself. Failed sign-ins are kept even when the request fails.

The log is append-only for every role, the organization's owner included.

Audit log · Northwind Labs Append-only

Scoped API keys.Built so they can't overreach.

Let your own systems create drafts, request approvals, get distribution quotes and read results. A key acts for the person who made it, within the scopes you choose, and loses access the moment that person does.

Approving, publishing, submitting distribution and sending outreach can never be granted to a key.

API key · CMS syncActs for Sam Ortiz

Signed webhooks.Your systems hear it first.

Get told when a release is approved or published, when distribution is submitted, accepted, completed, rejected or fails, when coverage is verified and when a campaign completes. Every delivery is signed, logged and retried if your endpoint is down.

Deliveries go only to public HTTPS addresses, so a webhook can't be turned against your own network.

Webhook · https://hooks.northwind.example/codiraHTTPS, public addresses only

Governance, without the friction.Built in.

Required MFA

Authenticator-app sign-in with recovery codes, required for everyone once you turn the policy on.

Financial Review

Financial releases need two approvers, neither of them the person who asked. Codira PR doesn't make disclosures for you.

Custom Roles

Any permission you hold, except deleting the organization. The database refuses edits to the built-in roles.

Separate by Design

Row-level security forced on every table that holds an organization's data.

Key Rotation

Rotate a key with a 24-hour overlap, set expiry dates and revoke at once. Only a hash of each key is stored.

Rate Limits

Sign-in, two-factor and per-key limits, failing closed if they can't be checked.

Not built yet.Said plainly.

Single sign-on through SAML or OIDC and OAuth client credentials aren’t available yet. Scoped API keys cover server-to-server use.

Many reviewers.One clear record of who did what.

Talk to Us See the Platform