cohenta
Get started
HomePricing

Product

How it worksCapabilitiesAsset typesProduct surfaces

Studios

CreativeVisualVideoResearch

Platform

DistributionIntegrationsQuality & TrustSolutionsSecurityThe engine

Company

AboutEnterpriseBlogNewsContactFAQ
Sign in · soonGet started

Platform security

We can’t leak what we never hold.

Runs execute on your Runner. Keys, assets, and campaign state stay yours. Our cloud is never in the execution path.

Request a walkthroughHow it works
Keys in your keychainOutbound-only connectionNothing of yours held
platform securitycustody map
the custody lineyour environmentRunner · executes hereprovider keyspublishing credentialscanonical assetscampaign stateCohenta cloudlicense checkssigned updatesdownloads · docstelemetry · optionallicense ping · update pulloutboundkeys · assets · statenever cross
Where custody endsyour side runs · our side verifies

The custody claim

“Cohenta never receives or stores your provider keys, publishing credentials, canonical assets, or campaign state. Data is shared only with the platforms and providers you have chosen.”

A custody claim, not a vanishing act: Slack and your model provider still process what you send, under your accounts. Cohenta keeps none of it.

Division of labor

Four jobs. No custody.

Everything our cloud does fits in one short column. Everything it never touches fills the other.

Our cloud does

  • License verificationConfirms your seat and tier. A yes or no — no run data attached.
  • Downloads and signed updatesServes the Runner and signed updates your machine can verify.
  • DocumentationGuides, references, and the manifest for your own Slack app.
  • Optional telemetryOpt-in and anonymous: versions and counts. Never content or identity.

It never touches

  • ExecutionEvery run happens on your Runner. No server-side fallback.
  • Keys and credentialsIssued by each platform to you. We hold no copy — nothing to breach.
  • Canonical assetsBriefs, brand files, and finished creative live on your storage.
  • Campaign statePlans, drafts, approvals — every run’s record stays on your side.

Built in

Decided by architecture, not policy.

Five properties that fall out of where the keys, the state, and the run sit. None needs enforcing.

References, not values

Config stores a pointer, never the key. The Runner resolves it in-process — no key in a log, a tool argument, or a call to Cohenta.

Outbound only

The Runner reaches Slack over Socket Mode, an outbound WebSocket — no inbound port, nothing to open. Your app comes from Cohenta’s manifest, so Slack issues its tokens to you.

The run waits for you

At the gate the run pauses — durably, across restarts. Approve or Request changes resumes that exact run; publishing needs its own confirm. A button press, never an inference.

Canonical state stays yours

Campaign state lives on your disk, database, or object storage. Start in Slack, pick it up from Teams or Claude — same campaign, same record.

One account, outside the run

Sign-in on the Thyn portal covers license, downloads, and account management — your subscription, never your runs.

Content governance

Two commands, logged

Watch a key stay yours.

LinkedIn issues the token, your keychain holds it, the Runner resolves a reference at call time. Nothing in this flow calls Cohenta.

Straight answers

Asked and answered.

Where do my provider keys live?
In your keychain or vault: macOS Keychain or Windows Credential Manager on a laptop; Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault in the cloud. The Runner reads them locally; Cohenta has no copy.
What does Cohenta’s cloud actually see?
License checks, download requests, docs traffic, and — if you allow it — anonymous telemetry: versions and counts, never content. Keys, credentials, assets, campaign state, and prompts never reach it, and no run routes through it.
How does Slack connect from behind our firewall?
Outbound: the Runner opens a WebSocket to Slack — Socket Mode — so nothing listens on your network and nothing needs port-forwarding. It works from an office server, a container, or a laptop.
What happens if I uninstall the Runner?
Everything stays exactly where it always was: keys in your keychain, assets and campaign state on your storage, deletable on your schedule. There is no Cohenta-side copy to request, export, or scrub.

Next step

Audit the boundary yourself.

Run the full path on your stack — install, connect, publish, approve. What reaches Cohenta: a license check.

Request a walkthroughRead the privacy policy