Product
Give the right people the right keys.
Codexroom owns its own role model. Governors hold the library. Creators compose decks. Viewers consume them. Authentication runs through Clerk. Membership and roles live inside your workspace.
In the product
The library, and the record of every change.
The library
Governors hold the brand system.
Tokens, slot types, slide templates, deck chrome, data-room assets, approver rules — authored, versioned, and published in one place. Only a governor can publish a template or approve a metric, and every version is kept.
The full role model- --token-accent#006DD5
- --token-bg-canvas#0F2440
- --token-font-display"Tiempos Headline"
- --token-radius-card12px
- --token-accent-soft#7FB3E8#5A9BDDdraft v5
d.okafor published tokens v4 · 12 templates re-rendered
audit log · every change versioned, nothing overwritten
The record
Every mutation writes a row.
Every token created, template published, deck assembled, share created, watermark forced off — written to an append-only audit log with the actor, the resource, the metadata, and the timestamp. The answer to who did what, when.
Read the security posture- Jun 12, 10:34d.okaforshare.created
- Jun 12, 09:58d.okafortoken.published
- Jun 11, 17:22a.riveradeck.sent
- Jun 11, 16:40d.okaforshare.revoked
- Jun 11, 14:03a.riveraasset.archived
The roles
Governor, Creator, Viewer.
Governor. Holds the library. Authors tokens, slot types, slide templates, deck chrome, data room assets, and approver rules. The only role that can publish a template or approve a metric.
Creator. Composes decks from the published library. Creates shares. Reads analytics on their own shares.
Viewer. Reads decks inside the workspace. The internal-facing reader.
Roles live in Codexroom's memberships table, never in Clerk. Clerk is the front door for sign-in. Codexroom decides what each signed-in user can do.
Under the hood
Isolation at the database, not the application.
Row-level security. Every domain table has an organization_id column. Every query passes through a tenant context that sets the active org, user, and role at the Postgres session level, and RLS policies enforce the scope at the database. No application code ever runs a "where organization_id = ?" by hand. Two tenants on the same instance cannot see each other.
Multi-tenant by subdomain. Each workspace lives at your-slug.codexroom.com. Members sign in once on the apex and stay signed in across the subdomain. Recipients open shares at codexroom.com/v/<token> so the URL never leaks the tenant.
SSO and SCIM. Clerk handles SSO with Okta, Azure AD, Google Workspace, OneLogin, and the SAML and OIDC standards. SCIM ships on Enterprise. Provisioning rules map the directory's group to a Codexroom role.
See it work