Account

Privacy and what gets indexed

What is sent for search, what is excluded, and which capture controls you can change.

The important boundary

ContextStream search is a hosted feature. Whether your editor connects through the hosted MCP URL or launches the local stdio server, eligible file contents are sent to ContextStream to build and operate the search index. The local helper validates the checkout and reads files on your machine; it is not a promise that indexed code stays on that machine.

If your policy forbids sending a repository to the service, do not index it. Use a separate project or exclude the sensitive paths before the first ingest.

The same boundary applies when an assistant is working with less supervision. Relevant context can surface automatically, but only from the authorized scope; grounding does not widen membership, override exclusions, grant execution permission, or make an external share safe without review.

What indexing excludes

The local ingest path applies all of these before upload:

  • Standard, nested, and global Git ignore rules
  • .git/info/exclude
  • Additional patterns in .contextignore
  • Known credential and editor-config directories
  • Secret-looking filenames, environment files, certificates, and private keys
  • Invalid UTF-8 files and individual files larger than 5 MB
  • Binary and media files, unless you explicitly choose to index supported media

Absolute local checkout paths and credentials embedded in Git remote URLs are not included in the uploaded project metadata.

These protections are defense in depth, not a substitute for secret hygiene. Do not commit secrets, and review .contextignore before indexing a repository with tracked material that should remain outside ContextStream.

Review a sensitive repository before first ingest

Suppose a client repository contains ordinary source beside generated customer fixtures, exported support logs, and a folder of signed test certificates. Before indexing:

  1. confirm the checkout belongs in the intended client workspace and project;
  2. keep generated fixtures and support exports outside the indexed boundary with .contextignore;
  3. make sure private keys, environment files, certificates, and credential directories are not tracked or relied on only as “probably filtered”;
  4. decide separately whether screenshots, recordings, or PDFs should be added as media;
  5. decide whether this editor may capture conversation transcripts.

Then run the initial ingest and inspect the indexed-file list. Ignore rules are easier to trust when you verify the resulting boundary instead of assuming a pattern matched.

If policy says no repository content may leave the machine, stop there and do not index it. Launching the standard-input server locally does not turn hosted search and memory into an offline product.

What the service holds

Project knowledge includes the decisions, lessons, plans, documents, tickets, and other records you or an authorized client save.

Search data is built from the eligible file contents sent during ingest. Removing a path from future sync does not rotate a secret that was already uploaded.

Transcripts and snapshots may include conversation content. Capture depends on the client and its configuration:

  • Setup-generated editor configurations enable normal context and hook transcript capture unless you turn it off.
  • A raw, unmanaged MCP configuration does not opt in merely by connecting.
  • Your assistant may keep its own local or provider-side conversation history. ContextStream's capture switches govern ContextStream records, not another product's separate retention settings.

Controlling editor transcript capture

Terminal
contextstream-mcp configure --transcripts off
contextstream-mcp configure --hook-transcripts off

The command updates configured editor files. Add --scope global, --scope project, or --scope all to choose where. --transcripts controls capture requested by normal context calls; --hook-transcripts controls supported editor-hook capture. You can disable either one independently.

If your policy forbids retaining conversation content, turn transcripts off and verify every connected client separately. An editor or assistant can retain conversation history independently of ContextStream.

Excluding more

Put ContextStream-only exclusions in .contextignore; use .gitignore when the files should be absent from both Git and indexing. Then run a fresh ingest or remove already indexed paths. Exclusions govern future reads; they do not undo disclosure of a secret, so rotate exposed credentials first.

Respond to an exposure in the right order

If a committed .env file or private key reached the index, treat the credential as exposed:

  1. rotate or revoke it first;
  2. remove the exact indexed path and refresh the project;
  3. add the appropriate Git and ContextStream ignore rules;
  4. inspect repository history and connected artifacts for the same value;
  5. verify the replacement secret was not copied into a transcript, document, ticket, media asset, or capsule.

De-indexing reduces future retrieval. It does not make a credential safe again and it cannot retract a value already copied to another system or recipient.

Deleting

Documents, decisions, sessions, projects, and individual indexed paths have their own removal controls. Deleting a memory record and de-indexing source are separate operations. Deleting a workspace is the broadest operation and removes the workspace's contents.

If it doesn't work

A secret was indexed. Rotate it — that's the correct first move regardless. Then remove the indexed path and add an ignore rule. If it is tracked in Git, also treat repository history as exposed.

Indexing picked up build output. It isn't ignored. Add it to .gitignore, which fixes it for git as well.

I need a strict no-upload workflow. Do not index that checkout. Local stdio still uses the hosted search and memory service; it is not a local-only index.

Next