TrigCode is how enterprises ship AI-built software — so the platform is built to enterprise expectations: explicit data controls, a reviewable audit trail, and integration with the identity stack you already run.
All traffic is served over TLS. Secrets held on your behalf — SSO client secrets, webhook signing secrets, 2FA seeds — are encrypted at rest with AES-256-GCM. API keys and SCIM tokens are stored only as SHA-256 hashes.
Enterprise workspaces bring their own identity provider over OIDC (Okta, Microsoft Entra ID, and others), with domain-claim approval to prevent takeover. SCIM 2.0 provisioning creates and removes members automatically as people join and leave your company.
Fixed four-role matrix (owner, admin, developer, viewer) enforced server-side on every request. Org context is validated per-request and never embedded in session tokens. Per-member monthly credit caps limit blast radius.
Workspace events including invites, role changes, key issuance, deploys, and SCIM provisioning land in a member-visible audit trail with actor snapshots that survive account deletion. Admins can export the trail as CSV.
TrigCode runs on AWS (Mumbai, ap-south-1) with PostgreSQL on RDS. Generated backends run in restricted Docker containers. Browser previews are currently served by the application tier while migration to a separate preview origin is completed.
Enterprise deploys push to YOUR AWS account via a cross-account role you control, scoped to named resources and guarded by an external ID. Code exports include Docker and Terraform so you are never locked in.
SOC 2 readiness work is underway, including control mapping and evidence collection across access control, change management, availability, and vendor management. No Type I audit has started and TrigCode is not currently SOC 2 certified. Enterprise customers can request our security whitepaper and current control status under NDA.
In AWS ap-south-1 (Mumbai, India). Payment card data never touches our servers — it is handled entirely by our payment processors: Razorpay in India and Paddle (Merchant of Record) internationally.
No. Prompts are processed by our model providers under their enterprise terms; we do not sell your prompts or generated code, and private apps are visible only to you and your workspace.
Email security@trigcode.com. We review reports and keep reporters informed through remediation.
A DPA template is available for enterprise legal review. Contact your account manager or sales@trigcode.com.
Found something? Email security@trigcode.com. We review responsible-disclosure reports and follow up through remediation.