# Business software & user agreement Version: 2026-11-02 Status: Business terms Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Business use of the Codaform desktop software, named-user licensing, trials and account services. ## Parties, scope and order documents These terms govern business use of Codaform software, website accounts and licensing services supplied by Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden. Contact info@codaform.se. The customer is the business identified in the accepted order. Anyone accepting on its behalf must have authority to bind that business. These terms form part of an order or agreement that incorporates them. A separately agreed written order takes priority over these terms for its specific commercial provisions. The data processing agreement takes priority for processing covered by that agreement. An existing signed agreement remains in force unless the parties agree to replace it. For purchases through Paddle, Paddle acts as merchant of record and its buyer terms govern the purchase, payment and associated consumer or buyer rights. These terms govern Codaform's software and services and do not amend Paddle's obligations. ## Licence and named users Subject to the applicable order and active entitlement, the customer receives a limited, non-exclusive right for its authorised named users to use Codaform for its internal business activities during the licence term. The software itself is licensed, not sold. Each assigned seat covers one person and one activated device. Three seats cover three named people, each with one device. Accounts and credentials must not be shared. A company owner or administrator may manage seats without occupying one; using the desktop software requires an assigned seat. Additional seats and custom allowances require Codaform approval. Administrators may invite, assign and unassign users within their approved allowance. Pending invitations reserve seats. To switch computers, deactivate the previous device before activating the replacement. Do not repeatedly rotate assignments to provide simultaneous access beyond purchased capacity. ## Trial and access checks The trial lasts 14 days and does not require a payment card. It does not automatically turn into a paid subscription. A paid upgrade starts billing at checkout or under the approved invoice terms. Trial eligibility and activation are checked against account and device records. Trials require online validation. Paid entitlements can permit up to seven days offline, capped by licence expiry. Revocation, unassignment or account changes cannot immediately invalidate a signed entitlement on a computer that remains offline. Access resumes only when the applicable checks succeed; expiry does not by itself remove the customer's locally held project files. ## Prices, renewal, invoices and cancellation The order and checkout show the applicable currency, price, taxes, billing interval and renewal terms. Published annual packages are not authority for a different custom quote. Paddle acts as merchant of record for Paddle purchases and handles payment and associated invoices. Annual subscriptions renew according to the purchase terms unless cancelled. Company billing administrators can access the customer portal from Billing & invoices. Approved invoice customers must follow the payment terms on the issued invoice; requesting an invoice alone does not grant paid access. Increasing a seat allowance in Codaform does not itself change Paddle charges. Any additional payment, prorating, renewal amount or complimentary grant must be agreed and recorded separately. Cancellation and refunds are distinct; see the cancellation and refunds document. ## Customer materials, generated output and third parties The customer retains its rights in its own designs, project files and materials. As between Codaform and the customer, the customer owns generated code and components created from its designs, subject to any third-party rights in imported content or dependencies and the internal-use restrictions below. Ownership does not grant permission to sell or distribute generated components outside the customer's business. Codaform retains its rights in the application, service and documentation. The customer must have permission to use imported code and materials and is responsible for checking generated output, dimensions, interfaces and engineering suitability before use. Autodesk Plant 3D and other third-party products have their own licences and compatibility requirements. Codaform does not grant rights to those products. ## Internal use of generated components Digital components created or exported using Codaform, including their generated Python code and component libraries, are for internal use within the customer business identified in the order. The customer and its users must not sell, resell, license, sublicense, distribute or otherwise supply these components or code to another person or business, whether for payment or free of charge. This restriction applies whether the components or code are supplied separately or included in another product, library or service. It continues after the subscription or agreement ends. It concerns digital components and generated code; it does not prohibit selling physical products manufactured using the customer's designs. ## Acceptable use and account security - Use valid business and billing details and keep recovery contacts current. - Protect credentials and devices; notify Codaform promptly about suspected unauthorised access. - Do not bypass licensing, disrupt services, distribute malware, access another customer's data or use the service unlawfully. - Do not resell or sublicense access unless a separate agreement allows it. Mandatory rights concerning interoperability or other legally protected activities remain unaffected. - Do not post confidential project data, personal information about others or credentials in public forum posts. Use an agreed support channel for sensitive material. ## Support, updates and availability Contact info@codaform.se for product, account and billing support. Our support policy explains how to report a problem. Standard support does not include guaranteed response or resolution times, continuous availability or service credits. Any agreed service levels are set out in the customer's written order or service agreement. Use supported releases and review release notes before updating. Test compatibility with your environment and keep backups of project files. You remain responsible for your network, devices, third-party software and validation of engineering output. ## Privacy, confidentiality and processing roles Our privacy policy explains how we handle account, licensing, billing and support information. The customer is responsible for its authority to invite employees and provide their information. Where we process personal data on the customer's instructions, the data processing agreement applies when incorporated into the order or service agreement. Each party must protect the other's confidential information using reasonable care, use it only to perform or exercise rights under the agreement, and disclose it only to people who need it and are subject to confidentiality obligations. These duties do not cover information already lawfully known, independently developed, lawfully received from another source or public without breach. Disclosure required by law is permitted, with advance notice where lawful. ## Suspension, termination and customer records We may suspend affected access for expired entitlements, non-payment, unauthorised use or a security risk. We will explain the reason and recovery steps where lawful and practicable. Immediate suspension is permitted where necessary to protect customers or the service. Contact support for human review of an incorrect access refusal. Either party may terminate for a material breach that remains unresolved 30 days after written notice identifying the breach. Serious unlawful use or a breach that cannot be remedied permits immediate termination. Termination does not remove accrued payment obligations or rights arising before termination. At the end of the licence term, stop using the licensed software unless access is renewed. Keep copies of your project files. Cancellation of renewal, return or deletion of personal data, and legally required retention are handled under the relevant billing and privacy terms. Confidentiality, ownership, accrued payment obligations and provisions intended to survive termination continue to apply. ## Warranties and liability We will provide the service with reasonable care and skill. If a material defect prevents the software from performing substantially as described in the applicable documentation, notify us with sufficient detail to investigate. We will make reasonable efforts to correct the defect or provide a suitable workaround. If neither is reasonably available, you may terminate the affected service and request a proportionate refund for the unused prepaid term, processed through the applicable payment provider. Codaform is an engineering tool. You are responsible for checking designs, calculations, dimensions and generated output before manufacture, construction or other use. We do not warrant uninterrupted or error-free operation or suitability for a purpose outside the agreed product specification. To the extent permitted by law, neither party is liable for indirect or consequential loss, lost profit, lost revenue or lost business opportunity. Each party's aggregate contractual liability is limited to the fees paid or payable for the affected service during the 12 months preceding the event giving rise to the claim. These exclusions and the liability cap do not apply to fraud, intentional misconduct, gross negligence, unpaid fees, or liability that cannot lawfully be limited. They do not restrict an individual's rights to compensation under applicable data-protection law or change Paddle's obligations under its buyer terms. ## Governing law and changes Swedish law governs the agreement with Codaform, excluding conflict-of-law rules. The parties will first attempt to resolve disputes through good-faith discussions. If no resolution is reached, disputes fall within the jurisdiction of the Swedish courts, with Örebro District Court as the court of first instance, subject to mandatory law. We may update these terms from time to time. The edition presented and incorporated when a new customer places an order applies to that order. For existing customers, updates take effect only through the change process below or a separate agreement. Publishing a new edition does not retrospectively change an existing agreement. We may correct typographical errors, improve formatting and clarify wording at any time without individual notice, provided the changes do not alter the parties' substantive rights or obligations. We will identify the updated edition on this page. We may make reasonable material changes to reflect changes in law, the service or its operating requirements. Material changes normally take effect at the next renewal. We will email the customer's designated business contact at least 30 days before that renewal, describing the changes, the effective date and how to decline renewal. The customer may cancel renewal before the changes take effect and retain access for the remainder of the current paid term. If the subscription renews after that notice, the notified terms apply to the renewed term, subject to mandatory law and any separately agreed written terms. Material changes during a current paid term require the customer's express agreement, except where an earlier change is reasonably necessary to comply with law or address an urgent security risk. Any such earlier change will be limited to what is necessary. We will explain the reason and effective date and give advance notice where practicable; if immediate action is necessary, we will notify the customer as soon as practicable afterward. If a necessary legal or urgent security change materially disadvantages the customer during a prepaid term, the customer may terminate the affected service by notifying info@codaform.se within 30 days of our notice. We will arrange a proportionate refund of unused prepaid fees for that service from the termination date through the applicable payment provider. This process does not limit mandatory rights or permit unrelated price increases or reductions in purchased licence rights during a paid term. The customer must keep its designated business contact details current. This change clause does not replace any separate notice or consent requirements for personal-data processing, subprocessors or Paddle purchases. ## References - [Paddle buyer terms](https://www.paddle.com/legal/buyer-terms) --- # Privacy policy Version: 2026-11-02 Status: Privacy notice Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Who handles personal data, why it is used, who receives it and how to exercise your rights. ## Controller and contact Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden, is the controller for the account, licensing, security and business-contact information described in this policy. Contact info@codaform.se or write to our postal address to ask about your data or exercise your rights. Your employer is separately responsible for the information it supplies and the decisions it makes when administering your company membership. Where we provide a service that processes data solely on a customer's instructions, the applicable data processing agreement governs that processing. ## Information and sources Information comes from you, company administrators, the desktop licensing client and service providers. It includes names and business emails; account and membership records; licence, trial, order and subscription records; legal business details, tax identifiers and billing contacts; installation identifiers, fingerprint hashes, optional device names, operating system and application versions; activation and security timestamps; support correspondence; forum contributions; and privacy-request records. The application can record pseudonymised IP identifiers and user-agent information for security. Pseudonymisation is not anonymisation, and infrastructure providers may receive raw network information separately. Paddle handles payment credentials; the website does not require your full payment card number. Licence activation and validation do not require project-file uploads. Files you send to support and information you publish in the forum are handled for those separate purposes. ## Purposes and legal bases | Purpose | Basis and limits | | --- | --- | | Accounts, company seats and licensing | Contract necessity where the person is a contracting party; otherwise legitimate interests in providing the business customer's service. | | Security, fraud and trial/licence abuse prevention | Legitimate interests in protecting accounts and services, subject to necessity and balancing against individual rights. | | Billing, financial records and rights requests | Compliance with applicable accounting, tax and data-protection obligations; contract performance or legitimate interests for administration of the business relationship. | | Support and business correspondence | Contract necessity where applicable or legitimate interests in answering enquiries and supporting customers. | | Forum participation | Legitimate interests in operating the requested business community; submitted content is visible to people who can access the forum. | | Optional analytics or advertising storage | Consent where required. We do not currently use an analytics or advertising provider on this website. | ## Required information and automated checks Account and device information is required to authenticate you and validate your licence. Without it, we cannot provide those functions. We automatically check trial eligibility, access status and device and seat limits. Contact info@codaform.se if you believe access has been refused incorrectly; you can request a human review. ## Recipients and international transfers Authorised Codaform staff and the relevant administrators of your company can access information needed for their roles. Forum content is visible to its audience. We use Vercel for hosting, Neon for the database, Resend for email, Cloudflare Turnstile for anti-abuse checks and Paddle for purchases. Our providers page describes their functions. Paddle handles purchase and payment records as merchant of record under its own privacy notice. We may also disclose information to professional advisers or authorities where required, to establish or defend legal claims, or in connection with a business transfer subject to applicable protections. We do not sell personal information. Processing locations depend on the service, its infrastructure and support arrangements. Transfers outside the EEA are subject to the GDPR's international-transfer requirements. Depending on the recipient and destination, the relevant protection may be an adequacy decision or contractual safeguards such as the European Commission's standard contractual clauses, together with supplementary measures where required. Contact info@codaform.se for the locations and safeguards applicable to your data and how to obtain a copy. ## Retention and deletion We retain account, company and licensing records for the duration of the service and as needed to resolve outstanding obligations, prevent licence abuse and handle legal claims. Support information is retained while the enquiry is active and for relevant follow-up or dispute handling. We assess retention against the purpose, sensitivity, applicable legal requirements and whether a less identifiable record is sufficient. Our standard application retention periods are 730 days for audit and notification history and 90 days after expiry for desktop sessions and device authorisation codes. Expired verification and password-reset tokens are removed through scheduled cleanup. Closed privacy cases have a recorded retention reason and deletion date. Longer retention requires a documented legal or security reason. Financial records are retained for the applicable statutory accounting and tax periods. Deleting an individual account does not erase shared company invoices or records we are legally required to keep. Support mail, provider records and backups are handled separately from active application records. Retained backup data remains restricted until scheduled expiry; deletion and restriction decisions must be reapplied if a backup is restored. Ask us for the retention period or criteria applicable to a particular record. ## Your rights Depending on the processing, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Portability applies only where its legal conditions are met. You can withdraw consent without affecting the lawfulness of earlier processing, and object to direct marketing at any time. Email info@codaform.se, including enough information to identify the account and request. No active subscription is required. We may ask for proportionate identity or authority verification; do not send identity documents unless requested. We respond without undue delay and normally within one month. Any justified extension, up to two further months, must be explained within the initial month. If we cannot fully comply, we explain the reason and available remedies. You can complain to Integritetsskyddsmyndigheten (IMY), the Swedish supervisory authority, or another competent authority, and seek a judicial remedy. See the GDPR requests guide for practical steps. ## Cookies, security and changes Our cookie policy explains authentication and preference storage and how to change optional-cookie choices. We protect access to personal data through authentication, role-based permissions and security logging. The security overview provides further information. We update this policy when our processing changes and communicate material changes through an appropriate channel. The date identifies the current edition. Changes do not retroactively alter your consent or an existing agreement. ## References - [GDPR, including Articles 12–22](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng/) - [IMY: individual rights](https://www.imy.se/privatperson/dataskydd/dina-rattigheter/) --- # Cookie & browser storage policy Version: 2026-11-02 Status: Cookie policy Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Authentication cookies, appearance/language preferences and controls for optional storage. ## How we use browser storage We use cookies and local storage to maintain secure sessions and remember your choices. Necessary authentication and security cookies support the service you request. We do not currently use an analytics or advertising provider on this website. ## First-party cookies and local storage | Name / storage | Purpose | Duration | | --- | --- | --- | | authjs.session-token / __Secure-authjs.session-token (possibly numbered chunks) | Signed-in account session; necessary | Configured session lifetime up to 30 days | | authjs.csrf-token / __Host-authjs.csrf-token | Authentication request protection; necessary | Session | | authjs.callback-url / __Secure-authjs.callback-url | Authentication return destination; necessary | Session | | ls_cookie_preferences | Remember optional-cookie choices | 180 days | | codaform_lang | Remember the language selected by the visitor | Up to one year | | codaform_theme (local storage) | Remember light/dark appearance; the script may initialise it from the system preference | Until cleared or replaced; no automatic expiry | ## Payment and anti-abuse services Protected forms use Cloudflare Turnstile to check for automated abuse. Paddle provides checkout and the customer billing portal. These services process browser and network information for their respective functions; their privacy notices explain their processing. The table above covers storage set by Codaform. Payment and anti-abuse services can use separate storage within their own flows. Optional analytics or advertising requires consent where applicable. You can use our cookie settings to manage optional categories. ## Choices and withdrawal Use Cookie settings below or in the footer to reject optional categories or change your preferences. Analytics and marketing controls are available, but neither category currently has a provider connected. Withdrawing consent affects future optional processing and does not affect the lawfulness of earlier processing. You can also clear cookies and local storage in your browser. Removing authentication cookies signs you out, and blocking necessary storage can prevent account functions. Clearing appearance or language preferences resets those choices. ## References - [PTS: cookies and consent](https://www.pts.se/internet-och-telefoni/kakor-cookies/) - [Cloudflare Turnstile privacy information](https://www.cloudflare.com/privacypolicy/) - [Paddle privacy notice](https://www.paddle.com/legal/privacy) --- # GDPR requests & data rights Version: 2026-11-02 Status: Customer guide Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se How employees, company contacts and former users can request access, correction or deletion. ## Make a request Email info@codaform.se with the subject ‘Privacy request’. You do not need a paid account. Include your account email, your relationship to the company if relevant, the right you want to exercise, and the information or time period concerned. Do not send passwords, payment-card details or identity documents in the initial request. Suggested message: ‘I am requesting [access / correction / erasure / restriction / portability / objection] concerning my Codaform account [email]. The scope is [description]. Please contact me at [reply address].’ A company representative should explain their authority. You can also write to Codaform AB, Fagermon 315, 705 91 Örebro, Sweden. ## Available rights - Access: learn what personal data is processed and obtain a copy, subject to others' rights and applicable exceptions. - Correction: correct inaccurate details and complete incomplete information. - Erasure: ask for deletion where a legal ground applies; this is not an unconditional right to erase invoices or other people's data. - Restriction and objection: ask us to limit processing or review legitimate-interest processing. Direct-marketing objections must be respected. - Portability: receive eligible data in a structured, commonly used, machine-readable form where the legal conditions apply. - Consent: withdraw consent for future processing without affecting earlier lawful use. ## What happens next We record the request and original receipt date, check identity or authority proportionately, and review the relevant systems and recipients. We normally respond within one month. A justified extension of up to two additional months must be communicated within the first month. Requests are normally free; any permitted exception must be explained. For employee data, your company may also need to respond as a separate controller. We will explain the relevant responsibilities rather than assuming that a company administrator can exercise every employee's rights. Exported data must be reviewed for third-party information and delivered through a suitable secure channel. ## Deletion, retained records and offline access Deleting an individual account does not automatically erase shared company billing history. Ownership transfers, financial obligations, lawful retention, provider records, support mail and backups may need separate handling. We explain retained categories, the basis and the review or deletion criteria in the response. Access restriction or erasure cannot immediately invalidate a signed desktop entitlement on a computer that is offline. Paid offline access can last until its signed expiry, currently up to seven days. This does not extend permission to use the service after an agreement has ended. ## Questions and complaints Contact info@codaform.se if you need clarification or disagree with the response. You can complain to IMY or another competent supervisory authority and seek a judicial remedy. The privacy policy supplies the controller's details and processing information. ## References - [IMY: your rights](https://www.imy.se/privatperson/dataskydd/dina-rattigheter/) --- # Data processing agreement Version: 2026-11-02 Status: Processing terms Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Terms governing personal data that Codaform processes on a business customer's instructions. ## Parties and application This data processing agreement applies when incorporated into an accepted order or service agreement between the business customer identified in that agreement (the controller) and Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden (the processor). GDPR terms have the meanings given in Regulation (EU) 2016/679. It covers only processing performed on the customer's documented instructions. Codaform's own account administration, licensing enforcement, security and merchant relationship activities are covered by the privacy policy where Codaform acts as an independent controller. In a conflict about the processing covered here, this agreement takes priority over general service terms. ## Processing schedule | Item | Scope | | --- | --- | | Subject matter and purpose | Personal data supplied by the customer for an expressly agreed support or other processing service, solely to deliver that service under the accepted order. | | Nature of processing | Receipt, storage, access, organisation, troubleshooting, secure communication, return and deletion as required for the agreed service. | | Duration | The service term plus the return and deletion period described below, subject to legally required retention. | | Data subjects | The customer's employees, authorised users and business contacts whose information is included in the agreed service. | | Data categories | Business contact details, user identifiers, correspondence and diagnostic information supplied for the service. Special-category data, criminal-offence data and additional categories require prior written agreement on purpose and safeguards. | | Instructions | The accepted order, this agreement and subsequent written instructions from the customer's authorised contact. Additional scope must be agreed before processing begins. | | Contacts | The customer's authorised contact recorded in the order; Codaform: info@codaform.se. | ## Instructions and confidentiality Codaform shall process personal data only on the controller's documented instructions, including instructions about international transfers, unless applicable Union or Member State law requires otherwise. Where legally permitted, Codaform shall inform the controller of that requirement before processing. Codaform shall promptly inform the controller if an instruction appears to infringe applicable data-protection law. The controller is responsible for lawful grounds, required notices and the lawfulness of its instructions. Codaform shall ensure that personnel authorised to process the data are bound by confidentiality obligations and have access only as required for their duties. ## Security measures For processing under this agreement, Codaform shall maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing. Measures shall include access controls and confidentiality, secure transmission, protection of stored data, recovery arrangements, security logging, incident handling and periodic assessment of effectiveness. The security and installation overview describes account and licensing controls. Any additional measures required by the processing service shall be specified in the accepted order. Codaform shall not materially reduce the overall level of protection during the service term. The controller remains responsible for the security of its own accounts, devices and systems. ## Subprocessors The controller grants general written authorisation for the subprocessors identified for the processing service in the accepted order or accompanying subprocessor schedule. The public providers page describes Codaform's wider service providers; it does not by itself authorise every provider for every customer processing activity. Codaform shall give at least 30 days' written notice before adding or replacing a subprocessor. The controller may object on reasonable data-protection grounds within that period. The parties shall work to resolve the objection. If no suitable solution is available, the controller may terminate the affected processing service before the change takes effect and receive a refund of unused prepaid fees for that service. Codaform shall impose data-protection obligations on subprocessors equivalent to those relevant under this agreement and remains responsible for their performance as required by GDPR Article 28. ## International transfers Codaform shall transfer personal data outside the EEA only on documented instructions and in accordance with GDPR Chapter V. The order or processing schedule shall identify the applicable processing locations and recipients. Where required, the parties shall use an appropriate transfer mechanism and supplementary measures before the transfer takes place. Codaform shall provide information reasonably needed by the controller to assess the transfer and its safeguards. If legally required processing prevents compliance with the instructions, Codaform shall inform the controller where permitted and cooperate on appropriate protective steps. ## Rights requests and incidents Taking account of the nature of processing, Codaform shall assist the controller with requests to exercise data-subject rights through appropriate technical and organisational measures. It shall promptly forward requests relating to the controller's processing and shall not respond on the controller's behalf unless authorised or legally required. Codaform shall notify the controller without undue delay after becoming aware of a personal data breach affecting the processing covered here. The notice shall provide available information about the breach, affected data and people, likely consequences, measures taken or proposed and a contact for follow-up. Information may be supplied in stages as it becomes available. Codaform shall assist the controller with applicable security, breach-notification, impact-assessment and prior-consultation obligations, taking account of the processing and information available. The controller remains responsible for its decisions and notifications to supervisory authorities and affected individuals. ## Return and deletion At the end of the processing service, the controller may choose return or deletion of the personal data. The controller must give its choice within 30 days; if it gives no instruction, Codaform shall delete the data. For a return request, the parties shall use a secure transfer channel and a commonly used format appropriate to the data. Codaform shall complete return or deletion of active copies within 60 days after the service ends, unless the parties agree a shorter period. Copies retained because Union or Member State law requires it shall remain protected and limited to that purpose. Backup copies shall remain isolated from ordinary use until their scheduled deletion under the backup retention period specified for the service. If restored, they remain subject to the controller's deletion and restriction instructions. Codaform shall confirm completion on request. ## Accountability and audits Codaform shall make available information necessary to demonstrate compliance with this agreement and shall allow and contribute to audits, including inspections, by the controller or its mandated auditor. The parties shall agree practical arrangements, reasonable notice and confidentiality protections that preserve other customers' data without obstructing statutory rights. Urgent incident or regulatory requirements may justify shorter notice. The governing law and dispute provisions of the underlying agreement apply, subject to mandatory data-protection law. Nothing in this agreement restricts data subjects' rights or the powers of a competent supervisory authority. ## References - [IMY: processor agreements](https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/personuppgiftsansvariga-och-personuppgiftsbitraden/personuppgiftsbitradesavtal/) --- # Security & installation review Version: 2026-11-02 Status: Technical overview Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Security controls, licensing data and deployment guidance for organisations using Codaform. ## About the service Codaform is operated by Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden. Our Windows engineering application uses web-based accounts for sign-in, company administration, licensing and billing. Contact info@codaform.se for security and procurement enquiries. This document covers our account and licensing services and the checks required for a managed desktop deployment. Installation requirements and integration compatibility depend on the release. Refer to the installation guide for the version you plan to deploy. ## Installation and deployment Use your organisation's normal software approval and deployment process. Before rolling out Codaform: - Download the release from the official Codaform download page. Record the version and verify the downloaded file against its published SHA-256 checksum. - Check the installer's publisher signature and certificate chain against your organisation's policy. Installer signing and licence signing are separate controls. - Confirm supported Windows and runtime versions, required privileges, installation paths, startup behaviour, update and uninstall procedures. Contact us for release-specific deployment questions, including silent installation. - Pilot the release on a managed device. Test endpoint protection, proxy access and import/export using approved sample data. Back up project files before updating. - Check Autodesk Plant 3D compatibility and integration prerequisites against the installation guide before deployment. ## Network connections HTTPS is required for production website and API connections. Installer downloads use HTTPS and may be served from a separate download host. To sign in, the desktop application requests a device code. The user approves the request through their browser, and the application receives a session bound to that device. The application uses this session to activate a licence and validate access. Contact us before configuring a restrictive network allowlist so that the destinations match your deployed release. Website infrastructure, email delivery, anti-abuse checks and payments use separate providers; desktop devices do not need direct access to every infrastructure provider. ## Licensing data Our licensing API processes the following information. Project files are not part of licence activation or validation. Files supplied separately for support are handled as support data. | Category | Purpose | | --- | --- | | Account and company membership | Identify the user and their assigned licence | | Installation ID and fingerprint hash | Associate requests with a device and help prevent misuse. The fingerprint is supplied by the client and is not hardware attestation. | | Optional device name, OS version and app version | Device management, compatibility and support | | Activation, validation and security timestamps | Access checks, auditing and incident investigation | | Pseudonymised IP identifier and limited user-agent | Security logging. Infrastructure providers may also process network information under their own service arrangements. | ## Authentication and access control - We hash account passwords with bcrypt. Sign-in requires a verified email address and checks account status and processing restrictions. Authentication and API endpoints apply rate limits to reduce abuse. - Website sessions have a 30-day lifetime and recheck account and session status. Desktop authorisation codes expire after ten minutes. Device-bound desktop sessions have a 90-day lifetime; the server stores hashes of their bearer tokens. - Management actions enforce role and company permissions on the server. Sensitive privacy operations require super-admin access and a verified request. Workforce SSO and MFA are not currently supported. - We sign licence entitlements with RSA-PSS and SHA-256. Production configuration requires a matching RSA key pair of at least 2048 bits. Private keys are server-side secrets and must never be distributed with the desktop application. ## Device limits and offline operation Each assigned licensed user may activate one device. Company administrators manage named employees within the approved seat allowance; extra seats need Codaform approval. To switch computers, deactivate the current device first. The 14-day trial is online-only. Paid signed entitlements allow up to seven days offline, capped by licence expiry. Offline revocation is delayed until the signed entitlement expires or the client reconnects. Company offboarding procedures should include managed-device access controls as well as unassigning the Codaform seat. ## Company security reviews Send procurement questionnaires and security requirements to info@codaform.se. Include the product version, planned deployment and any contractual requirements. For your approval process, request confirmation of the following: - Hosting and database locations, provider contracts, remote access and international-transfer safeguards. - Encryption at rest, access to secrets and signing keys, backup retention and recovery arrangements. - Installer signing, supported versions, updates and rollback procedures. - Incident escalation, operational monitoring and retention schedules. - Support availability and any required service levels. Response-time and uptime commitments require a separate written agreement. ## Report a security issue Email info@codaform.se with ‘Security report’ in the subject. Include the product version, affected function, steps to reproduce the issue and its impact. Exclude passwords, tokens, private keys and unrelated customer data. Contact us to arrange a secure transfer before sending sensitive evidence. Report suspected access to another company's data promptly. If a company device is lost, notify your company administrator and deactivate it. Test only systems you own or are authorised to assess; do not access other customers' data or disrupt the service. ## References - [Installation guide](https://codaform.se/docs/getting-started-installation/) - [Official downloads](https://codaform.se/downloads/codaform) - [Privacy policy](https://codaform.se/privacy) --- # Service providers & data processing Version: 2026-11-02 Status: Provider information Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se The services that support Codaform accounts, hosting, communications and payments. ## Our service providers | Provider | Service | Information involved | | --- | --- | --- | | Vercel | Website and API hosting | Requests, application execution and hosting logs. | | Neon | PostgreSQL database | Account, company, licensing, billing-reference and privacy-request records. | | Resend | Transactional email | Recipient addresses and verification, password-reset, invitation and notification messages. | | Cloudflare Turnstile | Anti-abuse checks on protected forms | Browser and network signals used to evaluate automated requests. | | Paddle | Merchant of record for purchases | Business billing details, checkout, payment, subscription and invoice information. | ## Processing locations and safeguards A service can involve hosting, support, logging, email delivery and backup processing in different locations. International transfers are subject to applicable data-protection requirements. Contact info@codaform.se for processing locations and contractual safeguards relevant to your service, or to submit a supplier questionnaire. For services covered by a customer data processing agreement, the applicable order or subprocessor schedule identifies the authorised recipients and processing locations. Provider changes follow the notification and objection procedure in that agreement. ## Processing responsibilities Codaform is responsible for the account, licensing and security processing described in our privacy policy. Providers support those activities under their respective service arrangements. Where Codaform acts as a processor for a customer, the applicable data processing agreement governs that service. Paddle acts as merchant of record and has its own responsibilities for purchase, payment, tax and invoice information. Its privacy notice applies to those activities. A provider's role depends on the processing it performs. ## References - [Privacy policy](https://codaform.se/privacy) - [Data processing agreement](https://codaform.se/trust/dpa) - [Paddle privacy notice](https://www.paddle.com/legal/privacy) --- # Cancellation & refunds Version: 2026-11-02 Status: Customer guide Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se Cancel renewals, retrieve invoices and request a refund for a Paddle purchase. ## No-card trial The 14-day trial does not collect a payment card and does not start billing automatically. There is no trial payment to refund. Choosing an optional paid upgrade starts the paid purchase under its checkout or invoice terms. ## Cancel renewal A company billing administrator can open Billing & invoices → Manage billing & invoices to reach Paddle's customer portal and manage the subscription. Paddle's standard buyer terms describe cancellation taking effect at the end of the current billing period. Check the confirmation and the terms of any separately negotiated invoice arrangement. Unassigning a seat, deleting a device or stopping use of the software does not cancel renewal. Cancelling a subscription is separate from requesting a refund. ## Request a refund For a Paddle purchase, contact Paddle buyer support or info@codaform.se. Include the order/transaction reference, purchase date, business name, billing email and the reason. Do not send card numbers or passwords. Refund eligibility follows the applicable Paddle buyer terms and refund policy, your purchase agreement and mandatory law. Cancellation alone does not entitle you to a refund for the current billing period. This policy does not restrict statutory rights. ## Invoices and billing corrections Open Payments in the Paddle portal to download available invoice PDFs. Contact support for an incorrect billing contact, business detail, tax identifier or disputed charge. Payment corrections and credit notes must be reconciled with Paddle; changing an employee's licence does not change a financial record. Extra-seat quotes must identify the amount, currency, tax treatment, term and any prorating before approval. An administrative seat increase alone does not bill the company. ## References - [Paddle buyer terms](https://www.paddle.com/legal/buyer-terms) - [Paddle refund policy](https://www.paddle.com/legal/refund-policy) - [Paddle buyer support](https://paddle.net) --- # Support & service boundaries Version: 2026-11-02 Status: Service information Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se How to obtain help, report incidents and agree company-specific support requirements. ## Contact and information to include Email info@codaform.se or use the contact form. Include the company/account, Codaform version, Windows version, affected function, the time and timezone, expected behaviour and a minimal reproduction. For billing, include the order reference; for privacy or security, identify that topic in the subject. Remove passwords, tokens, private keys and unrelated personal or confidential data from logs/screenshots. Ask for a secure channel before sharing sensitive files. Access to your device, environment or project files requires a separately agreed support arrangement. ## Availability and scope Standard support covers product, account, activation and billing enquiries by email. It does not include guaranteed response or resolution times, 24-hour coverage, uptime commitments or service credits. If your organisation needs defined service levels or escalation arrangements, agree them with us in writing as part of your order. Codaform can investigate product, account, activation and billing issues. Customer network policies, third-party products and engineering validation remain the customer's responsibilities unless an agreement says otherwise. Support cannot guarantee that every imported file or generated component meets a specific engineering or safety requirement. ## Updates and continuity Review release notes, minimum-supported-version information and installation guidance before updating. Test new versions with representative projects, retain backups and use your organisation's deployment controls. Ask for release-specific rollback instructions rather than assuming an older installer can safely read newer files. For an outage, retain the error/time and contact support. Paid offline access may provide a limited continuity window but is not a substitute for backups or a contractual availability commitment. Trials require online validation. ## Security and privacy escalation Send security reports and GDPR requests to info@codaform.se, identifying the topic in the subject. The security overview and GDPR guide explain what to include. Avoid sensitive attachments in the initial message; contact us to arrange a suitable transfer channel where needed.