Security first. Compliance built in.

How COORDINATOR keeps your department's decisions accountable, and your data yours.

Talk to sales

Northfield AthleticsSecurity

Close calls go to a person On
Append-only audit log On
Your own encryption key On
Your own model On
SAML SSO and SCIM On
Two-factor sign-in On

Waiting for review3

Maya OrtizNIL deal check

$1,500 · two posts · Lakeside Coffee

82%CorrectApprove

Apex TurfVendor emails

Three-year renewal at the same rate

41%Review

Women's basketballTeam travel booking

Charter to Eugene, $38,400 over budget

58%Review

If no one decides a review

After 4 hours

People stay in charge

COORDINATOR never acts. Your agents do, on its verdict.
Anything under a rule's bar waits for a person.
You decide what happens when no one answers.

The details

COORDINATOR never acts. It answers an agent's question with a verdict, how sure it is and why; the agent that asked does what the verdict says.
Anything below a rule's confidence bar waits for a person. Rules can always require a person, and compliance, finance, eligibility and medical rules do unless an owner says otherwise.
If no one decides a review, owners and admins choose what happens: it waits for a person, or COORDINATOR decides after the time they set.

Time	User	Via	Agent	Action	Target type	Detail
Oct 29, 2026, 10:44:12 AM	Dana Whitfield	dashboard	—	decision.reviewed	decision	{"call":"act"}
Oct 29, 2026, 10:51:03 AM	Jordan Hale	agent	Claude	rule.proposed	rule	{"rule":"nil-deal-check","version":4}
Oct 29, 2026, 11:02:40 AM	Marcus Lee	dashboard	—	rule.approved	rule	{"version":4}
Oct 29, 2026, 11:20:15 AM	Priya Shah	dashboard	—	agent.disconnected	agent	{"agent":"GrokBot"}
Oct 29, 2026, 11:36:58 AM	Sam Carter	agent	ChatGPT	decision.made	decision	{"verdict":"act"}
Oct 29, 2026, 11:41:22 AM	Tom Okafor	dashboard	—	context.uploaded	context	{"file":"NIL policy 2026.pdf"}

An immutable audit log

Added and read. Never updated or deleted.
Chained with SHA-256, stamped by the database clock.
Every decision and review fingerprinted.
Verify in one click. Keep the proof outside COORDINATOR.

The details

The audit log only ever grows. Entries are added and read, never updated or deleted: the database itself refuses any edit, deletion or truncation of an entry, so nothing in COORDINATOR can change one once it's written.
Every change, decision and review is written to it, one chain per organization. Each entry is chained to the one before it with SHA-256 and timestamped by the database's own clock, so entries can't be reordered, backdated or slipped in between.
Every decision and every review is fingerprinted into the chain as it happens, so a changed item, answer, verdict or review shows up when the log is verified.
Owners and admins verify the whole chain in one click; verification recomputes every hash in our application code rather than trusting the database. Each export is recorded in the log and carries the chain heads: keep them outside COORDINATOR, and a log rewritten later, even by someone with full access to the database, no longer matches them.
Each decision keeps its provenance: the rule version, the guidelines applied, the passages from Storage and precedents used, and the model that answered.

Azure OpenAI

AWS Bedrock

Google Vertex

Anthropic

AWS KMSReachable

Azure Key Vault

Google Cloud KMS

Your data and your keys

Encrypted in transit and at rest.
A data key of your own.
Hold it in your own KMS. Revoke it, and it's unreadable.
Close the organization and its data goes. The audit log stays.

The details

Data is encrypted in transit (TLS) and at rest by our database and storage providers.
Each organization has its own data key. Secrets such as your model's API key are encrypted with it.
Enterprise organizations can hold that key in their own AWS KMS, Azure Key Vault or Google Cloud KMS, set up with us at onboarding: each decision's item (and its summary) and Storage files are then encrypted with it as well. Revoke COORDINATOR's access to the key and those become unreadable to everyone, including us, within five minutes.
Your key doesn't cover rules, guidelines, decisions' answers and verdicts, review notes, Storage titles and file names, the audit log or agent call records; those are protected by our providers' encryption at rest. Backups hold what the database holds, so items encrypted with your key stay encrypted in them. Text search can't reach items encrypted with your key.
An organization only ever sees its own rules, decisions and Storage; teams narrow that further inside an organization.
Closing an organization deletes its decisions, rules, guidelines, Storage files and data key. The audit log is kept as the record.

COORDINATOR's modelNo retention

Your own model

Azure OpenAI

AWS Bedrock

Google Vertex AI

Anthropic

Your model

COORDINATOR's model by default, with no retention.
Or your own: Azure, Bedrock, Vertex, Anthropic or any compatible endpoint.
We replay your recent decisions on it first.

The details

By default decisions, and finding the passages in Storage they rely on, run on COORDINATOR's model through OpenRouter. We ask OpenRouter for providers that don't collect data and retain nothing, and send hashed ids rather than your organization's or people's own.
Or decide on your own, set up with us at onboarding: Azure OpenAI, AWS Bedrock, Google Vertex AI, Anthropic, or any OpenAI-compatible endpoint. Items, passages from Storage and precedents then go to your provider instead, for decisions, passage finding and trial replays alike, under your contract, and your API key is encrypted with your organization's own key.
Before you rely on it, we replay your recent decisions through it with you, so you can see how the verdicts change and adjust your rules' bars.

Enter the code from your authenticator

481

Identity and access

Invitation only, from your own email domains.
SAML or OIDC single sign-on, SCIM from your directory.
Two-factor sign-in, for anyone who turns it on.

The details

COORDINATOR is invitation-only: there's no sign-up. Your organization's email domains are set with us at onboarding, and only people on them can be invited; personal email addresses (Gmail, Yahoo, Outlook.com and the like) can't sign in at all.
Single sign-on with SAML 2.0 or OIDC (Okta, Microsoft Entra ID, Google Workspace and others). Once your domain is verified, everyone on it signs in through your identity provider.
SCIM 2.0 provisioning: people your directory assigns join your organization, and deactivating them in the directory ends their sessions and blocks sign-in.
Two-factor authentication with an authenticator app and backup codes, turned on per person, and asked for after every email-code sign-in. There are no passwords to steal or reuse.

Claude

ChatGPT

Gemini

Copilot Studio

GrokBot

Muse

Jordan Hale deactivated

Sessions Revoked

API keys Revoked

Agent sign-ins Revoked

Agents on your terms

Choose which assistants may connect.
Agents only act for the person who connected them.
Deactivate someone and every access ends at once.

The details

Agents sign in with OAuth and only ever act for the person who connected them.
Owners and admins choose which assistants may connect. An assistant that's blocked later is disconnected across the organization.
Deactivating someone, from your directory or by an admin, revokes their sessions, API keys and agent sign-ins at once.
Agents connecting, disconnecting and moving between organizations, and changes to which assistants are allowed, are written to the audit log.

Marcus Lee · Athletic directorOwner

Dana Whitfield · ComplianceAdmin

Jordan Hale · Women's soccerMember

Sam Carter · TravelMember

Alex Moreno · TicketingMember

NNorthfield Athletics

Compliance
Football
Women's soccer
Ticketing
Travel

NIL deal check

v4Act at 90% Live
v3Act at 85%
v2Act at 80%

Roles, teams and changes

The AD and administrators set the rules.
Teams for each sport and office.
Every change approved, every version kept.

The details

Owner, admin and member roles. People grant and change only roles below their own; owners can name other owners.
Owners and admins see the organization's decisions and approve changes; members see their own agents' decisions.
Teams narrow rules, guidelines and Storage to one sport or office.
Rule and guideline changes by members or agents are proposals until an owner or admin approves them. Every version is kept, with who proposed it and who approved it.

Questions

Security review or questionnaireWe'll answer it and walk your IT and compliance teams through COORDINATOR.Email us
Report a vulnerabilityTell us what you found. We'll confirm and keep you posted on the fix.Report it
See it on your own rulesWe start with one or two of your department's real rules.Talk to sales