Teams and Enterprise

Migrate a large codebase without sending it anywhere.

CodeMorph is local-first by architecture. Your code is scanned, graphed and verified on your developers' machines, and AI requests go straight to the provider you choose, under your own account.

Contact sales Security overview

Data flow

What runs where

The short version: we never receive your source code, because there's no CodeMorph server for it to go to.

Your machine

Editor and extensions
Parser and dependency graph
Graph database (local SQLite)
tsc and your test suite
API key, in OS secure storage
Ollama models, if you use them

Your model provider

Conversion and Ask requests
Sent with your key, on your account
Governed by your agreement with them
Skipped entirely with Ollama

CodeMorph

No source code
No telemetry from the app
Website forms only: email, message
Installer downloads via GitHub

If the architecture ever changes, this page and the changelog will say so first.

Controls

Built for security review

Bring your own key

Use your organization's Anthropic account and its data terms. Keys are stored in the OS's secure storage, never in settings files.

Fully local option

Point Morph at Ollama and run models on your own hardware. Scanning and verification never need a network at all.

No telemetry

Telemetry and crash reporting are disabled in the product configuration, not hidden behind a setting.

Auditable foundation

Built from MIT-licensed Code - OSS with a small, named patch set. Extensions come from Open VSX.

Teams

Migrate together

Planned for the Teams plan. Tell us what your team needs and it shapes the roadmap.

Planned

Shared plans

One migration plan for the repo, with batches assigned across the team.

Review in your flow

Verified batches land as branches ready for your normal pull request review.

Org policy

Set the allowed providers and models for everyone, including local-only.

Where we are

An honest picture

CodeMorph is an early-stage company in public beta

We don't hold SOC 2 or ISO 27001 certifications today, and we won't pretend otherwise. What we can do now: walk your security team through the architecture, answer your questionnaire, and work with you on a pilot that keeps everything on your machines. Because your code never reaches us, most reviews are short.

Deployment

Rolling CodeMorph out

CodeMorph is a desktop app. There's no server to host and nothing to run in your cloud.

User installer

Per-user install with no administrator rights. The simplest path for individual developers and pilots.

System installer

Machine-wide install for managed fleets. Distribute it with your existing software deployment tools.

Silent install

The Windows installers are built with Inno Setup and accept its standard switches, such as /VERYSILENT, for unattended installs.

Portable build

A .zip that runs without installing, for locked-down machines or evaluation.

Beta installers aren't code-signed yet. Signed builds are on the roadmap; until then, allow-list the installer by hash if your policy requires it.

Network

What CodeMorph connects to

A short, predictable list, so your network team can review it in minutes.

Destination	When
Your model provider, e.g. api.anthropic.com	Only when you convert files or use Ask, with your key
open-vsx.org	When you browse, install or update extensions
github.com	When you download an installer from Releases
Nothing else from CodeMorph	No telemetry, no crash reports, no CodeMorph servers

Standard editor features you use, such as git remotes or extensions you install, connect to their own services as they would in any editor.

Security review

What we can give your security team

· A walkthrough of the architecture and data flow with the people who built it.
· Written answers to your security questionnaire.
· Details of how installers are built: pinned upstream source, a named patch set and CI builds from tagged commits.
· The list of network destinations above, and confirmation that telemetry is disabled in the product configuration.
· Our vulnerability disclosure process and how fixes are released.

Read the security page, data use and model provider terms for the details in writing.

Pilot

Prove it on your own code

The best evaluation is a real repository. A pilot typically looks like this:

01
Pick a repository
A real JavaScript service or app with tests, owned by a team that wants TypeScript.
02
Scan and review the plan
Run Scan & Plan on a developer's machine and review the graph, cycles, batches and baseline error count together.
03
Migrate a slice
Migrate the leaf batches with your own model account, review every diff and run Verify.
04
Measure
Compare the baseline with the result: files typed, errors resolved, time spent reviewing, tests still green.
05
Decide
Roll out to the team, plan the rest of the migration, or tell us what's missing.

Procurement

Buying CodeMorph

Invoicing

Annual agreements with invoices, for Teams and Enterprise.

Custom terms

We'll work with your legal team on terms that fit your requirements.

Your model contract

Bring your existing Anthropic agreement. Usage is never resold through us.

Questions from security and platform teams

Does CodeMorph work offline or in air-gapped environments?

Scanning, planning and Run & Verify never need a network. Conversion and Ask need a model: your provider's API, or local models through Ollama, which is coming soon.

Where does our source code go?

It stays on your developers' machines. Conversion and Ask requests go directly from the editor to the model provider you configure, under your own account. There is no CodeMorph server in between.

Can we use our organization's own Anthropic account?

Yes. Every plan is bring your own key, so usage, billing and data terms sit with your agreement with Anthropic.

What admin controls are available?

Today, each developer configures their own key and model. Org-wide policy for allowed providers and models is planned for the Teams plan; tell us what you need and it shapes the roadmap.

Do you have SOC 2 or ISO 27001?

Not yet. We're an early-stage company and won't claim certifications we don't hold. We can walk your security team through the architecture and answer your questionnaire, and because your code never reaches us, most reviews are short.

How is the editor built?

From Code - OSS, the MIT-licensed core of VS Code, with a small, named patch set. Telemetry is disabled in the product configuration and extensions come from Open VSX.

Get started with CodeMorph for Teams.

Download the beta, open a project and see your migration plan in under a minute.

Contact sales Read the docs