Trust
Security
How Open Program spend licenses, fitness gates, and kill-switches keep Contracted Autonomy accountable — self-hosted or hosted.
Fitness is the gate
Coppergate's north star is Open Program Runtime: contenders compete under a spend license tied to Open IDs, promote through fitness and CI, and you Accept once. You set policy and hold a kill-switch. Success is Done writeback plus a Ship Receipt; production and default-branch writes stay policy-gated (off until you enable them).
SCM identity first
Sign-in uses GitHub or GitLab OAuth for identity. Repository access is granted separately through the GitHub App or GitLab project connect you install on the orgs and repos you choose. You can revoke either side from your SCM provider at any time.
Evidence before merge
Each delivery path is meant to leave inspectable signal:
- Structured brief and plan you can review
- Pull request / merge request diffs in your repository
- CI / test status where your repo provides them
- Run cost visibility so spend is not a black box
Least privilege by design
We aim to request only the scopes needed for the features you enable. Workspace data is scoped to your account and the SCM connections you authorize. See also our Privacy notice.
Open source posture
Coppergate is MIT-licensed. Self-host with Compose and your own keys, or try the hosted instance. Controls and providers continue to evolve in the open — see Limitations and the Changelog. If you need a security review for your org, write to hello@coppergate.ai.