Enterprise-grade security for your code
Your code deserves the same protection as your production systems. ContextStream is built with security at every layer.
Encryption
AES-256 at Rest
All stored data is encrypted using AES-256, the same standard used by banks and government agencies. Database encryption is enabled by default.
TLS 1.3 in Transit
All data transmitted between your machine and our servers uses TLS 1.3 with strong AEAD cipher suites. Legacy protocols (TLS 1.0/1.1) are disabled.
Network Security
HTTPS Everywhere
All endpoints enforce HTTPS. HTTP requests are automatically redirected to secure connections.
HSTS Enabled
HTTP Strict Transport Security ensures browsers always use encrypted connections to our services.
Modern Cipher Suites
Only strong AEAD ciphers are accepted. Weak and deprecated cipher suites are disabled.
CAA DNS Records
Certificate Authority Authorization records prevent unauthorized certificate issuance for our domains.
Access Control
Secure Authentication
JWT tokens with short expiry times. Support for OAuth with GitHub and Google.
API Key Security
API keys are hashed before storage. Keys can be revoked instantly from your dashboard.
Tenant Isolation
Strict data isolation between workspaces and users. Your data is never accessible to other customers.
No Staff Access
ContextStream staff cannot access your code or data unless you explicitly grant permission for support.
Data Privacy
No AI Training
Your code is never used to train AI models. We use your data solely to provide the ContextStream service.
Immediate Deletion
Delete your workspaces, projects, or account at any time. Deletion is immediate and permanent — we don't retain copies.
Smart Exclusions
We automatically skip sensitive directories like node_modules, .git, IDE caches, and files over 1MB during indexing.
GDPR Compliant
EU data subjects can request access, correction, or deletion of their personal data at any time.
Infrastructure
Cloud Security
Hosted on enterprise-grade cloud infrastructure with SOC 2 certified providers.
Encrypted Backups
All backups are encrypted with AES-256-GCM before storage. Regular backup testing ensures data recoverability.
Database Encryption
All databases use encryption at rest and encrypted connections. No plaintext data storage.
Secure Object Storage
File content stored in encrypted object storage with access controls and audit logging.
Security at a Glance
Questions about security?
We're happy to discuss our security practices in more detail.