Codi
Codi is a Dutch AI platform for public-sector professionals. It searches more than fifteen million official government documents, answers questions in plain language with a citation for every claim, and adds an organisation's own uploaded files.
What is Codi?
Codi is a secure AI platform built for the Dutch public sector, and it presents itself as the smart colleague for public policy work. Its publisher, Platform Codi B.V. of Zeist, is a joint venture between the firms JoinSeven and NCOD.
The product rests on a library rather than on a chat window. Codi brings together hundreds of verified official Dutch sources: policy documents and meeting minutes from central government, municipalities, provinces and the House of Representatives, municipal council information, parliamentary dossiers, local by-laws and policy notes, European, national and regional legislation, environmental visions and environmental plans, plus news sources and publications from knowledge institutes. The homepage claims more than fifteen million documents and over a thousand professional users, while the documentation puts the count at more than ten million, so the figure is best read as an order of magnitude.
Users ask questions in ordinary Dutch. A hybrid engine combines keyword matching with semantic search over an Elastic vector index, and each answer comes back with a reference to the underlying document, which the vendor claims down to line level. Beyond free-form questions, ten named applications cover work public bodies actually do: drafting replies to parliamentary, council, provincial and water authority questions, breaking a policy document down across the environmental planning cycle, answering legal questions under the Youth Act, an HR assistant, a BBV assistant for municipal accounting, harmonising old zoning plans, and a PDCA assistant.
Alongside the built-in library, organisations connect their own systems, such as SharePoint or a case management system, through the Model Context Protocol, or upload files directly into a secured environment. Documents can be grouped into collections that carry their own chat and can be shared with colleagues.
Sovereignty is the central argument. The platform runs on Scaleway with its data in the Netherlands, and the customer chooses the language model: Mistral, OpenAI through Azure, Anthropic Claude, or on request a local open-source model. The vendor states that customer content is never used to train models, and adds that Codi, like people, can make mistakes.
What it does
- Search more than fifteen million official government documents from a single interface
- Get a drafted answer with a reference back to the source document
- Produce a draft reply to a parliamentary, council, provincial or water authority question
- Upload your own files and dossiers and question them inside a secured environment
- Group documents into shareable collections and chat with a whole collection at once
- Generate summaries, timelines, comparisons and policy-cycle analyses
- Choose which language model answers your questions, up to a local open-source one
When to use Codi / When not to
A quick filter to help you decide if Codi is the right fit.
When to use Codi
- Policy officers at Dutch ministries, provinces, municipalities and water authorities who draft answers to parliamentary, council and provincial questions
- Spatial planning teams working through the Environment and Planning Act, from environmental visions to folding old zoning plans into a single environmental plan
- Social domain and youth care specialists who need legislation, local rules and case law on one screen
- HR and finance staff in public bodies handling collective-agreement questions or checking a proposal against the BBV municipal accounting framework
- Organisations under a digital sovereignty mandate that want to choose their own language model, up to a locally hosted open-source one
When not to use Codi
- Individuals: there is no self-service sign-up, and accounts are created only by an administrator at a subscribing organisation
- Anyone working outside the Netherlands, since the interface, the documentation and the entire source library are Dutch-only
- Teams that need programmatic access, as no public API is documented anywhere on the site
- Buyers who want to try software before committing: the only entry point is a sales demo, followed by a twelve-month contract
- Work involving material classified above the Dutch Vertrouwelijk level, which the vendor contractually forbids from entering the platform
How to use Codi
A typical end-to-end flow, from setup to results.
- Request a demo through the website; the vendor replies with a 30 to 60 minute session built around your own cases
- Agree a contract with Platform Codi, for which the default term is twelve months
- Start the implementation as a Data Discovery Sprint, whose Launch phase frames where Codi will help
- In the Validate phase, designs and proposals are tested with the people who will actually use them
- In the Awaken phase, Codi is built and configured and the required assessments are carried out
- Inventory the additional sources your organisation needs; almost any official, verifiable source can be connected
- Have an administrator create accounts, one by one or in bulk through a CSV upload
- Sign in at platformcodi.nl/app, where the login screen recognises your email domain and offers Microsoft single sign-on or a password
- Follow the short in-app onboarding, then start asking questions in plain language
- In the Deliver phase, users are trained, usage is monitored and the service is evaluated
Pros & Cons
Pros
- Prices are published openly, which is rare on a segment where a demo request is usually the only route to a number
- The verified public corpus is already assembled, so the public half of the product is useful without any ingestion work
- Every answer carries a reference to its source document, so a claim can be checked rather than taken on trust
- The legal pack is complete and public: general terms, user terms, an SLA, a data processing agreement, a privacy statement and a responsible disclosure policy, all versioned and dated
- Subprocessors are named individually with their processing location, and the customer picks the language model, up to a locally hosted open-source one
- Data is stored in the Netherlands and a fully EU processing chain is available
- The vendor is unusually candid about what it has not achieved, from the missing ISO 27001 certificate to the restore test it has yet to run
Cons
- Dutch-only in every sense, interface, documentation and library alike, which makes it unusable outside the Netherlands
- The homepage carries an ISO conform badge, yet the compliance page states only that stage one of the external audit is complete; no certificate is published and ISO 42001 is merely in preparation
- No free plan and no trial: the single entry point is a commercial demo, and there is no way to evaluate the product on your own
- No public API, so nothing can be automated or integrated programmatically
- A twelve-month term that renews silently, with three months' notice and no mid-term exit
- The SLA publishes target response times rather than contractual commitments, offers no out-of-hours cover and quotes no availability figure
- Choosing Anthropic Claude as the model sends prompts and document fragments outside the EEA, and no automated classification check runs at upload, so respecting the confidentiality ceiling rests entirely on the user
Pricing & Plans
There is no free plan and no free trial. The cheapest paid entry point is Codi Basic at EUR 60 per user per month; Codi Premium costs EUR 90 per user per month, and Codi Enterprise is quoted on request. All prices are stated exclusive of VAT and of any government levies. The general terms allow an annual adjustment each 1 January against the CBS services price index, with any larger increase announced three months in advance and giving the customer a right to terminate without cost. The fee is charged per user, or as a flat fee per organisation where an organisation-wide licence is agreed. Invoicing is in advance for the agreed period, payable within thirty days.
- chat with public government information
- all public sources in one platform
- creation of collections
- and one standard language model chosen for the organisation
- everything in Basic
- plus uploading your own documents into a secured environment
- access to several agents of your choice such as the parliamentary questions or youth care agent
- free choice between language models
- and sharing chats and collections within your organisation
- everything in Premium
- plus bespoke data sources and modules
- an unlimited number of users
- guided implementation and onboarding for your team
- and the ability to configure agents
Data, GDPR & hosting
A consolidated view of how Codi handles your data.
GDPR overview
Implementation is documented rather than merely asserted. A versioned privacy statement (v2.1, 7 August 2026) treats website visitors and platform users separately, and a full data processing agreement is published outright, not just offered on request. Eight data subject rights are tabulated with a thirty-day response commitment, and requests are routed to the employer wherever the employer is the controller. The supervisory authority is named: the Autoriteit Persoonsgegevens. Personal data breaches are reported to the customer within 48 hours with eight mandatory elements. Data leaves the EEA only if the customer selects a model hosted outside it, on standard contractual clauses, and the vendor writes openly that whether those clauses always suffice is contested within the privacy profession. DPIA, IAMA and AIIA frameworks are documented, and the platform is self-classified as a limited-risk system under the EU AI Act.
Who owns the data?
Under the general terms the customer keeps every right to the content it supplies. Platform Codi obtains only the licence needed to run the service, and that licence ends with the contract. The reverse holds too: the software, design, algorithms and documentation remain the vendor's, and using the product grants no ownership of the underlying technology. In GDPR terms the roles are split explicitly. The customer is controller for the documents, searches and prompts its staff put into Codi. Platform Codi is processor for those, and controller in its own right for only three things: account administration, security logging, and the public sources it collects to make the product work.
Reuse rights
The vendor states plainly that it does not train AI models on customer content, and that the same restriction is contractually imposed on every language-model supplier it uses. Five processing purposes are declared with their legal basis: delivering the service, security and incident detection, service improvement, invoicing, and the statutory tax retention duty. Service improvement draws on aggregated statistics only, such as session counts, error rates and response times, never on prompts or document content. To answer a question, only the prompt and the document fragments needed are sent to the chosen model, without any account data, so the model does not know who is asking; the search itself never leaves the vendor's own environment. API calls are logged with the body of the request, which means searches and prompts do land in security logs, although the content of uploaded documents does not. On the marketing site, analytics and retargeting run on consent, and the vendor states those tags were still switched off as of 7 August 2026.
Data retention & training
Hosting summary
The platform runs on Scaleway, a European cloud provider, on a Kubernetes cluster whose data sits in an Amsterdam data centre in the Netherlands; that is where the application, the database and uploaded documents live. The search index, holding document text and metadata, is hosted by Elastic Cloud in the EU, and Microsoft Azure provides the container registry and DevOps tooling in the EU without holding customer documents. Searching happens inside the vendor's own EEA environment, so a query never leaves it. Only the prompt and the document fragments needed to answer it go to the language model, and the customer chooses which one: Mistral AI in France and OpenAI through Azure OpenAI both stay inside the EEA, while Anthropic Claude processes in the United States, a transfer covered by standard contractual clauses. A locally hosted open-source model is available on request and avoids any transfer. Uploaded files are encrypted per file with AES-256-GCM before storage, the file key itself encrypted under a master key held in HashiCorp Vault, and all traffic runs over TLS 1.2 or higher.
Things to keep in mind
Risks and trade-offs to weigh before adopting Codi.
- Every answer looks authoritative because it cites a source, yet the vendor itself warns that Codi can be wrong and that important conclusions must be verified before they are used outside the organisation
- In public administration a fluent draft reply to a political question can be signed off faster than it was checked; the user terms forbid using AI output as the sole basis for a decision with legal effect, but nothing in the product enforces that
- Skill erosion is a real risk: officers who stop reading source documents themselves may lose the feel for a dossier that made them valuable in the first place
- No automated classification check runs at upload, so a single misjudgement can place a document into a system that was never cleared for it
- Choosing a model hosted outside the EEA quietly changes the risk profile of every prompt typed afterwards, and that choice is made once, at implementation, by someone who may not be the person typing
- Deletion is not immediate everywhere: backups keep data for 365 days and the offsite copy for up to 35 days beyond that
- The ISO conform badge on the homepage is easy to read as a certificate that does not yet exist
Setup & Integrations
Technical difficulty
Low on the technical side, heavier on the organisational one. Codi is a multi-tenant SaaS product reached through a browser, so there is nothing to install and each customer gets a logically separated environment. Administrators create accounts, in bulk by CSV if needed, and can switch on Microsoft Entra single sign-on from the organisation settings. The real effort lies elsewhere: a guided four-phase implementation, an inventory of the extra sources to connect, optional system connections whose cost depends on the systems involved, and a legal prerequisite of a signed data processing agreement plus a risk assessment before any internal or confidential document is processed.
Deployment
Integrations
Supported languages
Behind Codi
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Codi.
Frequently asked questions
Who is Codi built for?
What does Codi actually search?
How much does Codi cost?
Is there a free trial or a free plan?
Can I sign up on my own?
Are my documents used to train AI models?
Where is the data hosted, and does anything leave the EU?
Is Codi ISO 27001 certified, and does it offer an API?
Should you pick Codi?
Codi is a deliberately narrow product: one country, one sector, one language. That narrowness is the point. Its value comes less from the chat interface, which is unremarkable, than from a verified corpus of Dutch public information that would take a buyer years to assemble, and from the discipline of putting a source reference behind every answer, which is what makes the output usable in work that has to be defended.
What stands out most is the paperwork. For a sixteen-person publisher, the legal and security documentation is unusually complete: general terms, user terms, an SLA, a full data processing agreement, a versioned privacy statement and a responsible disclosure policy, all public and all dated. Subprocessors are named with their locations. More striking still is the candour. The vendor writes that its ISO 27001 certificate is not yet in hand, that multi-factor authentication on password accounts is still being rolled out, that the first full restore test has not happened, and that the sufficiency of standard contractual clauses is contested in the privacy profession. Very few vendors volunteer that list.
The commercial side is less accommodating. There is no free plan, no trial and no self-service sign-up, so the only way in is a sales conversation followed by a twelve-month commitment that renews silently. The SLA publishes targets rather than guarantees, and there is no public API. Prices are at least visible and honest: EUR 60 per user per month for the entry tier, exclusive of VAT and indexed annually.
In its current form the platform is young, since the third-generation rebuild shipped in May 2026 and the roadmap is active. For a Dutch public body that wants sovereign AI over its own policy information, it is a serious option. For anyone else, it is simply not addressable.
- Choosing a selection results in a full page refresh.
- Opens in a new window.