Contractors on your code, not on their laptop.
A browser workspace per contractor, no token in it, file transfer off, and a single step to remove them when the work ends.
acme · workspace created for dev@example.test
network: acme only · browser access through the front door
repository grant: acme/app
file transfer: off (the default)
agent profile: supervised · git token held by the broker
A laptop clone, or a workspace you own
Today it is a VPN and a clone on their laptop, or a remote desktop. Copies outlive the contract, tokens get shared, and remote desktops are slow for development.
| Question | VPN and a laptop clone | A Kodela workspace |
|---|---|---|
| Where is the code? | On their laptop, for as long as they keep it | In a container on your host, reached in the browser (unless your organisation turns on members’ own computers as hosts) |
| Where is the git token? | In their credential store, easy to share | In the git broker on your host, under the guarded security level |
| Can they download files? | They already have everything | File transfer is off by default, and every change to it is audited |
| What happens at the end? | You ask them to delete it | dev-offboard archives their workspaces and ends their sessions |
| What can you see? | VPN connection logs | A per-person audit: egress, git, identity, workspace |
Four steps, start to finish
The contractor's browser reaches the front door, and the front door reaches their workspace on your organisation's network. Nothing is installed on their machine.
- InviteAccess is by invitation only. There is no public sign-up.
- Grant one repositoryRepository grants are per member.
- File transfer off, profile supervisedOff is the default. Supervised agents read and propose; they edit and run nothing alone.
- OffboardAt the end of the contract, run one command.
$ dev-offboard dev@example.test- Home
- Archived, then the user is deleted
- Workspaces
- Archived
- Sessions
- Ended. Disabling an account alone does not end them.
- Record
- Written to the identity audit stream
What you get, and what to weigh
- Benefits
- No local copy by default. A one-step exit. A per-person audit.
- Security considerations
- Code can still leave through the terminal or a screenshot: detectable, not preventable. Desktop attach, if you enable it, bypasses the file-transfer rule. ssh, scp, rsync and ftp are refused on any port on your host, unless file transfer is set to both.
- Several vendors
- Give each vendor its own organisation, with its own network, members and settings. Give your client the read-only auditor role.
- Deployment model
- A single host you run. A contractor’s workspace stays there unless your organisation turns on members’ computers, where the source sits on that computer’s disk. See deployment.
- Proof
- No customer story is published yet. Pilots are how that evidence will be gathered.
Questions we get
Can a contractor still copy the code?
Yes, by hand. What the terminal shows and a screenshot are detectable, not preventable. File transfer off closes the paths Kodela controls: the Files pane, the browser IDE’s download and upload, and scp, sftp, rsync, ssh and ftp from the terminal. It does not make copying impossible.
Can they use their own editor?
VS Code runs in the browser. Desktop VS Code or JetBrains can attach over ssh only if your organisation turns it on, and attach bypasses the file-transfer rule, which is why it is off by default.
Is the git token ever in their workspace?
Not under the default guarded security level: the broker on your host holds it. Under the open or metered levels, the token is mounted in the container.
How is this different from a VPN?
A VPN decides who reaches your network. Kodela decides what a workspace can reach, and records what was written there.
Do invitations arrive by email?
Only once you configure outbound mail. Until then the invitation link is shown to the admin to pass on. Invitations last 7 days.
What it does not do yet
Know these before a contractor logs in.
- Copying by hand is not prevented. Code can still leave through the terminal or a screenshot: detectable, not preventable.
- Desktop attach bypasses file transfer. It is off until an admin turns it on, and the switch names the risk.
- Members’ computers put the code on a laptop. Off by default. If a platform operator grants it and your organisation turns it on, a member’s own computer can host their workspaces: the source on its disk is readable by whoever uses it, and egress there is observed, not enforced. Tested end to end only on Windows.
- Egress starts in observe. It logs and allows until you set deny.
- The shared front-door password is not personal. Turn on per-person identity to make every session attributable.
- No organisation deletion. Offboarding removes people; an organisation cannot be deleted yet.
Bring your next contract
Talk to us about a pilot, or bring up a host yourself.