---
title: "Security — Coline"
description: "How Coline protects your data, and how to report a vulnerability."
url: https://coline.app/security
---

[Sign in](https://coline.app/auth/signin)

[Sign up](https://coline.app/auth/signup)

[Sign in](https://coline.app/auth/signin)

[Sign up](https://coline.app/auth/signup)

# Security at Coline.

How we protect your data, and how to report a vulnerability.

Last updated: October 11, 2026

## Report a vulnerability

Email [security@coline.app](mailto:security@coline.app) with a description of the issue, the steps to reproduce it, and its impact. We’ll confirm we received your report, keep you updated while we fix it, and credit you if you’d like.

- Test only against your own accounts and workspaces.
- Don’t access, change or delete other people’s data, and stop as soon as you reach data that isn’t yours.
- Don’t run denial-of-service tests, spam, social engineering or physical attacks.
- Give us a reasonable chance to fix the issue before you disclose it publicly.

We won’t take legal action against good-faith research that follows these rules.

## Accounts and access

**Sign-in.** Passwords, Google, GitHub and Microsoft sign-in, single sign-on for organizations, and multi-factor authentication.

**Sessions.** Encrypted, HTTP-only session cookies, with protection against cross-site request forgery.

**Permissions.** Every workspace request checks the person’s role and sharing settings. Agents and apps act only within the permissions of the person they act for, or the scopes a workspace approved.

**Credentials.** API keys, tokens and Git credentials are stored hashed. App secrets, integration tokens and Code environment variables are encrypted.

## Data protection

**Encryption.** Data is encrypted in transit with TLS and at rest by our storage providers.

**Infrastructure.** Coline runs on major cloud providers. See our [subprocessors](https://coline.app/subprocessors) for the list.

**Isolation.** Anything you or your agents run in Code runs in an isolated sandbox. Kairo runs code in its own separate sandbox.

**AI.** We don’t use your content to train AI models, and our AI model providers don’t either.

## Operations

**Staff access.** Access to production systems is limited to the people who need it.

**Monitoring.** We log and monitor requests, rate-limit sensitive endpoints, and investigate abuse.

**Backups.** The primary database is backed up regularly.

**Incidents.** If a breach affects your personal information, we’ll notify you and regulators as the law requires. Business customers are notified as described in our [Data Processing Addendum](https://coline.app/dpa).

## Security questions

Email [security@coline.app](mailto:security@coline.app) to report a vulnerability or ask about security. For privacy questions, email [privacy@coline.app](mailto:privacy@coline.app).