Security
Read-only by design.
Coharyn is built to learn from enterprise systems without the ability to change them. Discovery connections are read-only by construction, and the only write path is a quarantined, sandbox-only component.
Read-only source discovery
Sources connect with least-privilege read-only accounts. Sessions are set read-only, and a connect-time write probe must fail before any learning begins. Every generated query passes an AST-level guard that permits only single-statement reads, blocks DML/DDL and dangerous functions, and enforces row limits and timeouts. Every query is fingerprinted and audited.
Tenant isolation + RLS
Tenant data is isolated at the application layer and enforced again by PostgreSQL row-level security, so the database refuses cross-tenant access even if application code forgets a filter.
RBAC + SSO architecture
Role-based access control governs every action. Enterprise SSO uses OpenID Connect (Authorization Code + PKCE) with signed state, nonce and JWKS-verified tokens.
Quarantined transformation writer
Migration rehearsal writes only to a Coharyn-owned sandbox. The writer refuses any target not explicitly flagged as sandbox. Production source databases are never written to.
Deterministic execution + auditability
Validated knowledge compiles to deterministic checks that run without continuous model inference. Actions are recorded in an audit trail; knowledge carries explicit evidence and lifecycle states.
Contained AI
No raw customer rows are sent to an external model by default. Database content is treated as untrusted input and fenced as data. The platform runs fully with no model provider configured.
What we do not claim.
- No SOC 2 / ISO 27001 / GDPR certification (not yet obtained)
- No customer case studies until a real one exists
- Validation results are from controlled, synthetic estates
- No public SLA unless separately agreed
Responsible disclosure
If you believe you have found a security issue, please contact security@coharyn.com. See our responsible disclosure page.
Start with a private pilot.
Connect Coharyn read-only to one unfamiliar system, or several. See what it discovers, with evidence, before you commit to anything.