# Security & installation review

Version: 2026-11-02
Status: Technical overview
Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden
Contact: info@codaform.se

Security controls, licensing data and deployment guidance for organisations using Codaform.

## About the service

Codaform is operated by Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden. Our Windows engineering application uses web-based accounts for sign-in, company administration, licensing and billing. Contact info@codaform.se for security and procurement enquiries.

This document covers our account and licensing services and the checks required for a managed desktop deployment. Installation requirements and integration compatibility depend on the release. Refer to the installation guide for the version you plan to deploy.

## Installation and deployment

Use your organisation's normal software approval and deployment process. Before rolling out Codaform:

- Download the release from the official Codaform download page. Record the version and verify the downloaded file against its published SHA-256 checksum.
- Check the installer's publisher signature and certificate chain against your organisation's policy. Installer signing and licence signing are separate controls.
- Confirm supported Windows and runtime versions, required privileges, installation paths, startup behaviour, update and uninstall procedures. Contact us for release-specific deployment questions, including silent installation.
- Pilot the release on a managed device. Test endpoint protection, proxy access and import/export using approved sample data. Back up project files before updating.
- Check Autodesk Plant 3D compatibility and integration prerequisites against the installation guide before deployment.

## Network connections

HTTPS is required for production website and API connections. Installer downloads use HTTPS and may be served from a separate download host.

To sign in, the desktop application requests a device code. The user approves the request through their browser, and the application receives a session bound to that device. The application uses this session to activate a licence and validate access.

Contact us before configuring a restrictive network allowlist so that the destinations match your deployed release. Website infrastructure, email delivery, anti-abuse checks and payments use separate providers; desktop devices do not need direct access to every infrastructure provider.

## Licensing data

Our licensing API processes the following information. Project files are not part of licence activation or validation. Files supplied separately for support are handled as support data.

| Category | Purpose |
| --- | --- |
| Account and company membership | Identify the user and their assigned licence |
| Installation ID and fingerprint hash | Associate requests with a device and help prevent misuse. The fingerprint is supplied by the client and is not hardware attestation. |
| Optional device name, OS version and app version | Device management, compatibility and support |
| Activation, validation and security timestamps | Access checks, auditing and incident investigation |
| Pseudonymised IP identifier and limited user-agent | Security logging. Infrastructure providers may also process network information under their own service arrangements. |

## Authentication and access control

- We hash account passwords with bcrypt. Sign-in requires a verified email address and checks account status and processing restrictions. Authentication and API endpoints apply rate limits to reduce abuse.
- Website sessions have a 30-day lifetime and recheck account and session status. Desktop authorisation codes expire after ten minutes. Device-bound desktop sessions have a 90-day lifetime; the server stores hashes of their bearer tokens.
- Management actions enforce role and company permissions on the server. Sensitive privacy operations require super-admin access and a verified request. Workforce SSO and MFA are not currently supported.
- We sign licence entitlements with RSA-PSS and SHA-256. Production configuration requires a matching RSA key pair of at least 2048 bits. Private keys are server-side secrets and must never be distributed with the desktop application.

## Device limits and offline operation

Each assigned licensed user may activate one device. Company administrators manage named employees within the approved seat allowance; extra seats need Codaform approval. To switch computers, deactivate the current device first.

The 14-day trial is online-only. Paid signed entitlements allow up to seven days offline, capped by licence expiry. Offline revocation is delayed until the signed entitlement expires or the client reconnects. Company offboarding procedures should include managed-device access controls as well as unassigning the Codaform seat.

## Company security reviews

Send procurement questionnaires and security requirements to info@codaform.se. Include the product version, planned deployment and any contractual requirements. For your approval process, request confirmation of the following:

- Hosting and database locations, provider contracts, remote access and international-transfer safeguards.
- Encryption at rest, access to secrets and signing keys, backup retention and recovery arrangements.
- Installer signing, supported versions, updates and rollback procedures.
- Incident escalation, operational monitoring and retention schedules.
- Support availability and any required service levels. Response-time and uptime commitments require a separate written agreement.

## Report a security issue

Email info@codaform.se with ‘Security report’ in the subject. Include the product version, affected function, steps to reproduce the issue and its impact. Exclude passwords, tokens, private keys and unrelated customer data. Contact us to arrange a secure transfer before sending sensitive evidence.

Report suspected access to another company's data promptly. If a company device is lost, notify your company administrator and deactivate it. Test only systems you own or are authorised to assess; do not access other customers' data or disrupt the service.

## References

- [Installation guide](https://codaform.se/docs/getting-started-installation/)
- [Official downloads](https://codaform.se/downloads/codaform)
- [Privacy policy](https://codaform.se/privacy)