Tiden

Tiden for enterprise

Ship with proof.

The audit trail for AI-generated code: what each change was for, what checked it, who signed off. Kept as the work happens, checked against the record rather than the session that produced it.

See what is recorded
Release 2026.09.12 · mainVerdict · pass
  • Requirements verified14 of 14
  • Checks run212 · 0 failing
  • Risk accepted1 · named, with a reason
  • Production issues in scope0 open
  1. Password reset link expires after 30 minutes3 checks · pass
  2. Sessions end when the password changes5 checks · pass
  3. Account export includes archived usersrisk accepted · M.K.

Snapshot locked at release · 14:02 UTC · the database refuses updates

Built by the team behind Qase, a testing platform used by 2,000+ teams

  • SOC 2 Type II
  • SOC 3
  • ISO/IEC 27001
  • Claude Code
  • Cursor
  • Copilot
  • Codex

Built with the audit in mind

Requirement to release, kept by the system. Nothing reconstructed the week before an audit.

Intent, captured first

  • Session hooks record what was asked
  • The change lands as a requirement branch
  • A person reviews it before it merges

Only the checks at risk

  • A change resolves to the components it can affect
  • Their tests run while the agent is still in the loop
  • Missing checks get written, not skipped

A verdict with the reasons attached

  • Coverage, pass rate, residual risk, production issues, freshness
  • Hard failures cannot be accepted away
  • Soft ones need a named person and a written reason

Frozen at release

  • One traceability snapshot per release
  • The database refuses updates to it
  • Legacy verdicts without provenance are marked, not trusted

Production routes back

  • Exceptions grouped to the release and the change
  • Each issue lands on the requirement it belongs to
  • SDKs for six languages, source maps, symbolication

Every action, with its actor

  • Requirements, tests, branches, releases, gates, roles
  • Web, API, agent or system on every event
  • Queryable through the API by actor, type and date

Controls a security review can point at

The record is what a SOC 2 change-management control asks to see: the change, the test evidence, the approver and the date, kept by the system. Around it:

2FA and passkeys

The organisation can require two-factor authentication, with a grace period and admin reset.

Roles at every level

Owner, admin and member at organisation, workspace and product, with additive inheritance.

Activity log

Every action on the record carries who did it and whether it was a person or an agent.

No secrets in CI

CI signs in with the OIDC token GitHub or GitLab issues per run. Tokens carry an expiry.

Encrypted vault

Model and integration credentials envelope-encrypted with AES-256-GCM, per workspace.

Isolated tenancy

Every request resolves to its organisation before anything happens. A denial looks the same as not found, so nothing can be enumerated.

SAML and SCIM are not available today. Ask, and you get a date in writing. Request the reports

Built for the people who carry the release

For engineering leaders

  • The ship call reads a verdict instead of assembling one
  • The review queue stops growing with agent output
  • Evidence for the audit, collected as the work happens

For platform teams

  • Hooks for Claude Code and Codex; MCP and CLI for the rest
  • Thresholds and enforcement set per product
  • One command installs the CLI: tiden setup

For security and release

  • Controls you can point at in a review
  • A named acceptance with a reason, never a blanket override
  • SAML and SCIM: not today, and we say so

For engineers

  • The loop reruns until green
  • A red gate names the unproven requirement
  • Tests live in your repository, nothing to extract

Why the release meeting got longer

Generation got cheap. Verification did not, and the ship call is still assembled from opinions in a channel nobody keeps. The research says so too.

  1. 25x

    more CI jobs in six months at Anthropic, with Claude writing 80% of the code. Running every test on every change “doesn’t scale: CI gates get increasingly long, expensive, and untrustworthy.”

    Anthropic, September 2026
  2. 46%

    of developers distrust the accuracy of AI output. Adoption is at 84% and rising; trust is not.

    Stack Overflow Developer Survey 2025
  3. DORA

    AI adoption still correlates with lower delivery stability: “Without robust control systems, like strong automated testing, mature version control practices, and fast feedback loops, an increase in change volume leads to instability.”

    2025 DORA report

Questions we get

From security reviews, platform teams and the people who own the release.

Still have one? Write to us.

Where does our code go?

Tiden reads the repository through the GitHub App or a GitLab registration and anchors requirements to file paths and line ranges. Model calls go to the provider you configured, with your own key. Your data sits in an organisation only its members can resolve, and every request is checked against that membership before anything happens.

An agent wrote the code and an agent wrote the tests. Isn’t that grading its own homework?

It would be, if the tests were the standard. Tiden checks the change against the requirement captured before the session started, kept as its own record, and the existing test repository defends against regressions the new tests never mention. A requirement with no test blocks the gate. Whether the requirement was the right thing to build is domain judgment, and that stays with your people.

Do you support SAML and SCIM?

Not today. Sign-in is email and password, with two-factor authentication the organisation can require and passkeys. Ask us where SAML and SCIM sit on the roadmap and we will give you a date, in writing.

Can we pull the audit trail out?

The activity log is queryable through the API with filters for event type, actor, source, workspace, product and date range. Verdicts, the per-criterion evidence and the traceability matrix are available through the public API with a token. A packaged export bundle per release is not built today.

Which agents does it work with?

Claude Code and Codex are wired by the installer. Anything else that can run a shell command and hold a token works through the MCP server and the CLI: Cursor, Copilot, your own harness.

How do we start?

With one repository that matters. We set it up with you in the first week: reporters, CI, MCP, the first gate. The pilot runs 90 days on your baseline and ends with a straight answer either way.

Ready to ship with proof?

Bring the security questionnaire. We would rather answer it before the pilot than after.

hello@tiden.ai