--- title: "Secure Development Workflows | Protect source code and development environments" description: "Move development from unmanaged laptops into self-hosted, governed environments on your infrastructure. Centralize controls and keep source code secure." image: "/_next/static/media/OpenGraph.37da9236.jpg" --- ![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fshield-violet.d01b7f59.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Secure Development Environments # Protect source code and development environments. Move development from unmanaged laptops into self-hosted, governed environments on your infrastructure. Centralize controls and keep source code secure. [Install Coder](https://coder.com/docs/install)[See Coder in Action](https://coder.com/demo) ![Two Column Masthead Background](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Ftwocol-premium-masthead-bg.8b7ffea4.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsecure-dev-environment-hero.7b30f7f3.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ## Laptops weren't designed to be your security perimeter Source code, credentials, and development tools often live on developer laptops outside centralized controls. As teams grow, organizations face unmanaged access and limited visibility. Coder moves development onto infrastructure you control, with access, dependencies, and tooling managed centrally instead of laptop by laptop. ### Source code containment - Workspaces run on your cloud, on-prem, or air-gapped infrastructure. - Source code, credentials, and tooling stay inside your infrastructure. - Keep secrets in your existing vault. ### Network isolation - Workspaces run in isolated networks with template-defined allow lists. - Agent Firewall extends default-deny network policies to AI coding agents. - Allow and deny decisions are all logged centrally. ### Identity and audit - SSO and SCIM integration with your existing identity provider. - Every workspace and agent action is attributed to a named user. - Audit events export to your SIEM. - SOC 2 Type II certified. ### Enterprises deploying Coder at scale. ![Discord Logo](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fdiscord-black-small.1f465509.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Skai Logo](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fskai-black.852176f6.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Square Logo](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsquare-black.6b0eed03.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Payabl Logo](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpayabl-flat-black.522eb86d.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Palantir Logo](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpalantir.5a80a692.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpayabl-black.923043ff.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) > One or two clicks and developers can start working. Sharing reports, exposing ports. It's all built-in. And because it's hosted remotely, we don't need expensive laptops or worry about local Docker vulnerabilities. Sumeet RoyDevOps Engineer @ payabl ## Build with tools you love ![Claude](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fclaude-squircle.1ddbcdcc.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Goose](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgoose.58af7d2e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Aider](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Faider.a575cb36.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Kiro](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkiro.c700ea24.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Gemini](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgemini.86c87b35.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![GitHub](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgithub-logo-white.cb8a80b7.png&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenCode](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopencode.972feec3.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenAI](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopenai-white.bf0b622e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Auggie](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fauggie.5105add1.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Sourcegraph Amp](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsourcegraph-amp.4f54b69a.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Cursor](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcursor.e112be7e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Claude](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fclaude-squircle.1ddbcdcc.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Goose](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgoose.58af7d2e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Aider](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Faider.a575cb36.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Kiro](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkiro.c700ea24.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Gemini](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgemini.86c87b35.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![GitHub](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgithub-logo-white.cb8a80b7.png&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenCode](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopencode.972feec3.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenAI](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopenai-white.bf0b622e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Auggie](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fauggie.5105add1.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Sourcegraph Amp](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsourcegraph-amp.4f54b69a.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Cursor](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcursor.e112be7e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Claude](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fclaude-squircle.1ddbcdcc.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Goose](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgoose.58af7d2e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Aider](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Faider.a575cb36.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Kiro](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkiro.c700ea24.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Gemini](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgemini.86c87b35.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![GitHub](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fgithub-logo-white.cb8a80b7.png&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenCode](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopencode.972feec3.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![OpenAI](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fopenai-white.bf0b622e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Auggie](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fauggie.5105add1.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Sourcegraph Amp](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsourcegraph-amp.4f54b69a.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Cursor](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcursor.e112be7e.svg&w=128&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ## With Coder, development happens on infrastructure you control. Platform and security teams gain centralized visibility, access controls, and governance while developers work in secure, reproducible self-hosted environments. ## Centralized and isolated workspaces - Workspaces run on your cloud, on-prem, or air-gapped infrastructure, accessible from any IDE. - Configure network policies per template with explicit allow lists for sanctioned services. - Source code, credentials, and tooling stay inside your perimeter, never on endpoint laptops. [![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcloud-white.0e03898d.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Workspaces](https://coder.com/docs/user-guides/workspace-access)[![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fglobe-white.453239a2.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Network policies](https://coder.com/docs/admin/networking)[![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpadlock-white.5b4e6a27.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Air-gapped](https://coder.com/docs/install/airgap)[![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fselect-white.c6d947ff.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Templates](https://coder.com/docs/admin/templates) ![Coder Templates UI showing starter templates to select from or an option to upload a template](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsecure-central-workspaces.e49c5811.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ## Access control and audit logging - SSO and SCIM integration with your existing identity provider applies to every developer and agent. - Every workspace and agent action is attributed to a named user. - Audit events stream to your SIEM. - SOC 2 Type II certified. [![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkey-white.84f7d782.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Identity](https://coder.com/docs/admin/users)[![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcog-white.f1180027.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Audit logs](https://coder.com/docs/admin/security/audit-logs) ![Product UI showing Deployment settings in the admin and General is selected](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsecure-access-control.86ad5ff3.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ## Built for regulated industries - Deploy on cloud, on-prem, or air-gapped infrastructure to meet data residency requirements. - Used by U.S. Defense Intelligence Organization with centralized ATO compliance for 2,500+ developers. - Open source core, fully inspectable architecture, and a public security policy for review. [![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fshield-white.e65be70c.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Security policy](https://coder.com/security/policy)[![](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fpage-white.a0453481.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91)Compliance](https://coder.com/docs/admin/security) ![Coder product UI showing deployment and compliance settings for regulated industries](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsecure-regulated-industries.d1e4b3ac.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ![Gradient Background](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstat-slider-bg.6cb15c83.jpg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) Skydio reduces cloud computing costs by 90% with Coder [Read the case study](https://coder.com/success-stories/skydio) ![Skydio](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fskydio-white.24ca3b0c.svg&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) ## Related content ## Related content [![Secure Environments for 2,500+ Developers (U.S. Defense Intelligence Organization) customer story](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fus-defense-intelligence-organization-customer-story.74a9d6ea.png&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) Customer Story ### Secure Environments for 2,500+ Developers (U.S. Defense Intelligence Organization) See more](https://coder.com/success-stories/u-s-defense-intelligence-organization)[![State of Development Environments 2025 white paper](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstate-of-dev-envs.e2d5908f.png&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) Whitepaper ### State of Development Environments See more](https://resources.coder.com/hub/col/resource-center/state-of-development-environments)[![Coder at a glance data sheet](https://coder.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcoder-at-a-glance.9f08675b.png&w=2048&q=75&dpl=dpl_5vbcKKjuYQkHJzr3nApt5oBH8j91) Datasheet ### Coder at a glance See more](https://resources.coder.com/hub/col/resource-center/coder-agents-overview) ## FAQs Is Coder compliant with regulations like GDPR or DORA? Coder helps you meet compliance goals by running entirely within your own infrastructure. This means your data stays where you control it—critical for meeting FedRAMP, GDPR, DORA, and similar requirements. Is Coder SOC 2 Type II certified? Does Coder work with my existing tools? How does Coder support compliance in highly regulated industries? What IDEs and languages are supported? Is Coder secure enough for regulated industries? Can I use Coder with AI coding agents or ML workloads?