In all areas from infra to application, we apply best practices like minimum privileges, separation of roles, and effective monitoring. Beginning April 2023, we intend to maintain a thorough third party accreditation program, including:

Documented Risk Assessment and Mitigation
Penetration testing and vulnerability scanning
Employee eduction and training
Information Security Auditing (e.g. SOC2, ISO27001, HITRUST)

Data Access

Coherence has access to 2 important services, your source provider (github, gitlab, bitbucket) and your cloud provider (GCP, AWS, Azure, etc...)

Source Provider Access

GitHub

On github, we use a github app installed on coherence-enabled repos in order to receive webhooks for push events and create check runs to communicate CI status. We can also support a Personal Access Token (PAT) if you prefer - just shoot us a note to support@withcoherence.com. Users OAuth to our github app and receive repo-scoped tokens that Coherence stores and uses to authenticate users automatically for our Workspaces, as well as when submitting builds or creating branches from our UI.

Cloud Provider Service Account

You are always in control of what role this account has and can audit or remove access at any time via your cloud provider's IAM tools. This service account is used to manage resources in your cloud account on your behalf, and generates further service accounts for more granular use as/where appropriate. Wherever possible, Coherence uses best practices like Workload Identity to minimize key handling as well as systems such as Cloud KMS to encrypt what keys we do store when at rest.

GCP

On GCP, you grant a coherence-managed service account (that we generate uniquely for each application) an "Owner" (or otherwise a custom role which still requires enough permission to manage your account) in your cloud IAM controls.

AWS

On AWS, we create an IAM user in an account that we control. This same IAM user is than granted permission, by you, to manage resources on your behalf.

It's important to note that you can grant access to new "test" accounts in either system when first testing Coherence - you don't need to connect to your current cloud projects and data until you want to use existing databases in those projects.

Vendor Risk

We know that Coherence, when used fully, takes on a critical role in your software team. Choosing a vendor that will become a daily part of your engineering workflow is not a decision to be taken lightly. As part of our own diligence into vendors, we think about things the same way.

We break the risk of choosing Coherence as a vendor into 3 parts, and address each part below:

Company solvency: will we still be around in X years?
Impact radius: if we went away overnight, would your company stop running?
Security and privacy risk: is choosing Coherence going to get your company hacked?

Company

Coherence is founded by an experienced team of tech leaders. We are funded by tier-A venture capital firms and a group of accomplished angel investors. We have substantial runway remaining, and strong prospects for continued growth and financing. Each customer we add makes our company stronger, so by using Coherence you're de-risking this part of the choice.

Impact Radius

We have designed our system from the ground-up to remove as much of the risk to your uptime from Coherence's actions as possible. In fact, it's one of the strongest reasons to choose Coherence over an alternative solution such as a Platform-as-a-Service. If we were to vanish overnight with no warning, nothing would happen to your already deployed environments or resources, and your customers would not notice that anything had changed. Ultimately, Coherence sits between your developers and your cloud, not your cloud and your users.

Environments without a custom domain, which use a SOMETHING.coherencesites.com URL, will have a dependency on the DNS systems and domain registration for coherencesites.com remaining available. You can apply a custom domain to each environment on a per-environment basis in Coherence, and it's unlikely that a customer-facing environment would use such a domain.

That said, we want to highlight both the gap that our disappearance would create as well as the steps we would plan to take if we did choose to wind down. To state it clearly, we do not intend to disappear with no warning, but rather to work as your partner in the unlikely event that this becomes necessary.

You would become responsible for replacing the scripts and configuration files that Coherence generates for you, including the Infrastructure-as-Code, CI/CD pipelines, and workload deployments (e.g. ECS on AWS or Cloud Run/GKE on GCP). You'd also need to train your team on how to use the scripts and files, for example to create an environment or deploy a commit, since it is unlikely you'd build a UI as easy to use as our dashboard.
Coherence is committed to making this transition easy, providing artifacts such as the last version of scripts used as well as the terraform or other similar state and configuration files. Many of these files are already present in your cloud resources and can be viewed or downloaded without any involvement from Coherence. If a situation arises where Coherence is winding down, we will reach out with more information on where to find these resources and spend time transitioning you to an alternative workflow with advance notice!

Security and Privacy Risk

As outlined in the rest of this document, Coherence takes every commercially reasonable measure to architect our systems for low risk to your data and customers. You always remain in control of our access to your cloud systems, and can audit our activity continuously using systems we do not control. Additionally, you can revoke our access at any time.

Responsible Disclosure

Please report any bugs, vulnerabilities, publicly available/hosted confidential information, or other relevant information to security@withcoherence.com. We'd appreciate it if you granted us private notice at that address before any public disclosure.

Terms

You agree to two different terms and conditions during your use of Coherence.

The Terms of Use and Privacy Policy on withcoherence.com govern the information collected on our public marketing site and associated pages.
The Trial Use Agreement governs our use of the application at app.withcoherence.com and the information we collect in the course of providing the services to you and your team. You accept these terms when you register your team on our platform. If you have any questions or concerns about the agreement, please reach out to hello@withcoherence.com and we'll be happy to discuss them.