AI coding agents, governed like the rest of your engineering
Set the rules once on your server. Every developer's Qorvyn enforces them: which capabilities agents may use, which paths and branches are off-limits, which providers are allowed. Identity, seats and audit come from the systems you already run.
Organization policies
Denied capabilities, protected paths and branches, allowed providers, time limits, delivery rules, the highest autonomy agents may run with, and whether new agents start with write access, per workspace. Every linked device enforces them; projects can only be stricter.
SAML, SSO groups and SCIM
Sign in with SAML 2.0 or OIDC (Microsoft Entra ID, Okta, Google) and map groups to workspace roles. SCIM 2.0 creates, updates and deactivates people automatically, and keeps groups in sync.
Audit export
Export the audit log as JSON or CSV by date range, set retention from 30 days to 10 years, and stream every entry to your SIEM with HMAC-signed webhooks.
Seats and live enforcement
Seat, membership, device and minimum-version decisions are enforced online. Deactivating someone blocks every device and frees the seat immediately.
Runners and secrets
Run a pool of runners in your own Azure, approved and priced like any change. Keep work on dedicated runners, give them secrets from your Key Vault (references only, audited), and cap how much runs at once.
Spending under control
Require a budget for every run, have a second person approve large ones, cap each month per workspace, and report what providers charged.
Assurance levels
Enhanced: every task proves itself with checks. High: people approve every plan, only managed runners work, and nothing with outside effects runs before an approval.
Evidence that holds
The audit log is a hash chain. Enterprise signs checkpoints daily, writes them once to your immutable storage when you configure it, exports proofs you can verify offline, and places legal holds.
Security never lapses
If a license expires there is a grace period, then paid features stop. Policies, governance rules and legal holds already set keep being enforced: expiry never weakens security.
Runs in your cloud
Self-host the team server, one binary on your PostgreSQL, in your own Azure, AWS or data center, with your own backups and monitoring. Hosted cloud is planned.
Not a fork. The same server, with more.
Your server runs qorvyn-server-ee: the Qorvyn Core server with Enterprise built in, turned on by your license. Developers' machines stay on Core: on their next sync they receive your policy, and their dashboard shows Enterprise.
- No migration: existing workspaces and devices keep working
- Core improvements reach you with no merging
- Enterprise collects nothing extra from developers' machines
# start the server with Enterprise QORVYN_EE_LICENSE=… qorvyn-server-ee server start \ --database-url postgres://… --public-url https://team.example.com # keep work on your own runners, approve big spending twice qorvyn team api PUT /v1/ee/workspaces/:ws/governance \ --body '{"runners":{"pool":["pool:acme"]},"budgets":{"approvalAboveMicros":100000000}}' # set the organization policy qorvyn team api PUT /v1/ee/workspaces/:ws/policy \ --body '{"deny":["git.push"],"protectedPaths":["infra/**"]}' # connect your identity provider (SCIM) qorvyn team api POST /v1/ee/workspaces/:ws/scim-tokens
Bring Qorvyn to your organization
Licenses are per seat. Tell us about your team, your identity provider and where you want to host, and we will set up a trial license.