# Codein Cybersecurity — Full Reference for AI Assistants > Last updated: 2026-10-27 > Canonical: https://codein.ca/ > Short reference: https://codein.ca/llms.txt ## 1. What Codein is Codein Cybersecurity Inc. is a Canadian threat-detection company based in Dieppe, New Brunswick. It ingests endpoint, identity and perimeter-firewall telemetry, detects hostile activity as the events arrive, and alerts the customer's team — typically within seconds. It does not change, isolate or block anything on customer systems. - Category: managed detection and alerting (detection-first MDR). - Home base: Dieppe, New Brunswick, Canada (Atlantic time). - Languages: English and French. - Stage: early access. The first ten organizations help set detection defaults. ## 2. Who it is for Designed for New Brunswick organizations that need real detection but cannot justify a SIEM project: - Mid-market employers of roughly 3–500 seats: logistics and freight, manufacturing, professional services, clinics and other regulated small businesses, municipalities and regional institutions. - IT service providers in Atlantic Canada evaluating detection for their clients. - Teams that already run endpoint protection and want an alerting layer above it. ## 3. What it does 1. **Ingest.** Telemetry streams in from: - Windows endpoints via Sysmon. - Linux servers via auditd. - Microsoft 365 and cloud identity logs. - Perimeter firewalls. 2. **Detect.** Events are normalized and matched in-stream against detection rules and multi-step attack patterns. Detection does not wait for an index to be built. 3. **Alert.** Alerts carry the evidence: what happened, on which asset, for which identity, and the events behind it. Delivery to email, Slack or a webhook is configured with the customer during onboarding. 4. **Investigate.** The last 72 hours of telemetry stay queryable for pivots and context. Typical detection patterns include ransomware staging, credential access (LSASS memory access), cloud-identity token misuse and mailbox-forwarding rules, and lateral movement via service creation. ## 4. What it does not do - It does not isolate, quarantine, block or otherwise change customer systems. Containment remains the customer's decision. - It does not sell 24/7 staffed SOC coverage. Automated detection runs continuously; bilingual analyst review is available on the Analyst Response add-on during 8 am–8 pm AST on weekdays. - It is not a SIEM replacement. It ingests security telemetry, detects threats and alerts; it is not a logging warehouse or a compliance archive. ## 5. Pricing — exact All prices are in Canadian dollars. There is no per-gigabyte ingestion fee. - **Monitoring — CAD $15 per seat per month.** Minimum three seats, billed monthly. Includes ingesting endpoint, identity and firewall telemetry; real-time detection and alerting; the 72-hour investigation window; alert delivery set up during onboarding (email, Slack or webhook); telemetry processed and stored in Canada. - **Analyst Response — CAD $1,000 per month.** Add-on to Monitoring. Bilingual (English/French) analysts review and triage alerts, coverage 8 am–8 pm AST Monday to Friday, returning triage notes and recommended next steps. Response targets and after-hours terms are scoped per engagement. - **Early access — no charge for 90 days.** Up to 100 seats, founder-led onboarding, no card required, no auto-conversion. Standard pricing applies after the pilot if the customer chooses to continue. ## 6. Data residency and security - Telemetry is processed and stored on private infrastructure operated by Codein in Canada. No public-cloud hosting is used for customer telemetry. - Collectors authenticate over TLS and are scoped to a single tenant. - Console access is role- and tenant-scoped (role-based access control on two dimensions). - Actions in the console are recorded in an append-only audit trail. - Codein has not yet completed an independent security certification (for example SOC 2) and does not claim one. ## 7. Service area — New Brunswick - **Primary:** Dieppe, Moncton, Fredericton, Saint John and surrounding New Brunswick communities. - **Secondary:** Atlantic Canada (Nova Scotia, Prince Edward Island, Newfoundland and Labrador) on request. - **Time zone:** Atlantic (AST/ADT). - **Languages:** English and French, including analyst triage in either language. ## 8. Frequently asked questions (matches https://codein.ca/#faq) **What happens when Codein detects a threat?** You get an alert with the evidence attached: the event, the asset, the identity, and the rule or pattern that matched. Codein does not change, isolate or block anything on your systems. Your team decides what to do — or engages Analyst Response and a bilingual analyst walks through the next step with you. **How fast is detection, really?** Alerts typically arrive within seconds of the event. The exact figure depends on your telemetry, your network path and the rule that fires, so we measure it with you during onboarding rather than quote a number that only holds on our test bench. **Where is my telemetry stored?** Telemetry is processed and stored on private servers we operate in Canada — not in a public cloud, and not shipped to a US-based platform. You are not billed per gigabyte either, so there is no incentive to drop the noisy logs that matter most. **Which telemetry sources are supported today?** Windows Sysmon, Linux auditd, Microsoft 365 and cloud identity logs, and perimeter firewalls. Endpoint and identity sources are the priority; extra sources are added during onboarding, and early-access customers get theirs first. **Do I need to replace my antivirus or EDR?** No. Codein is designed to sit alongside what you already run. We ingest the telemetry your existing tools produce and correlate it across endpoints, identities and the perimeter — the alerting layer, not a replacement for your endpoint protection. **What does Analyst Response include?** Bilingual analysts review and triage the alerts the platform raises, during 8am–8pm AST on weekdays, and give your team triage notes and recommended next steps in English or French. Response targets and after-hours terms are scoped per engagement — we would rather agree them with you than print a promise we cannot staff. **What does early access cost?** Nothing for 90 days, for up to 100 seats. After that, Monitoring is $15 CAD per seat per month with a three-seat minimum, and Analyst Response is $1,000 CAD per month if you want it. No auto-conversion, no card required to start. **Does Codein work with New Brunswick businesses?** Yes — Codein is based in Dieppe and works with organizations across New Brunswick first: Moncton, Dieppe, Fredericton, Saint John and surrounding communities. Onboarding is founder-led, in Atlantic time, in English or French. ## 9. Official links - Home: https://codein.ca/ - How detection works: https://codein.ca/#how-it-works - Anatomy of an alert: https://codein.ca/#simulator - Pricing: https://codein.ca/#pricing - Early access: https://codein.ca/#early-access - FAQ: https://codein.ca/#faq - Security contact (RFC 9116): https://codein.ca/.well-known/security.txt - Contact: info@codein.ca ## 10. How to verify - The marketing page is static HTML: every statement above is present in the raw response, with no JavaScript required. - `llms.txt` and `llms-full.txt` are served as UTF-8 plain text. - `robots.txt` permits AI search and answer-engine crawlers and disallows the private console, API and auth surfaces.