Trust, stated honestly.
What we read and store, the boundaries around it, who we rely on to run the service, and where we stand on compliance. In one place.
What we handle, and the limits around it.
Your data
What reaches ContextStream, what we keep, and what only happens with your consent.
- What we read
- Eligible source files you choose to index, plus the project knowledge and conversation history you choose to save.
- What we store
- Stream events, Atlas nodes and edges, citations, and Capsule manifests. Encrypted at rest.
- Deep project learning is optional
- Off until you consent. Private account guidance, no model training, and deletion within 30 days of withdrawal.
Boundaries
Who can see what, what a recipient receives, and what gets recorded.
- Scopes
- Personal, project, team, client, agent-visible. Boundaries enforced in product.
- Redaction
- Author-visible diff between source slice and recipient view. Capsules and cross-scope promotions both.
- Audit
- Promotions, opens, revocations, and agent actions logged. Exportable to SIEM.
Who we rely on to run the service.
We use the following subprocessors to operate ContextStream. Material additions trigger advance notice for Enterprise customers; the list is updated when it changes.
| Provider | What they do for us |
|---|---|
| Cloud infrastructure providers | Application hosting, data storage, network delivery, and object storage. A named list is available for Enterprise review on request. |
| AI processing providers | Search and language processing under service agreements that prohibit training on customer data. A named subprocessor list is available for Enterprise review on request. |
| Stripe | Billing, subscription management, and payment processing. |
| Resend | Transactional email delivery (verification, receipts, notifications). |
| Fastmail | Email hosting for the ContextStream team. |
| PostHog | Product analytics to understand usage and improve the experience. |
| GitHub | Source code hosting and CI/CD for the ContextStream codebase and release artifacts. |
| Slack | Team communications and internal coordination for the ContextStream team. |
Where we are. Where we’re going.
Audit underway
SOC 2 Type II
Type II audit underway. Scope and timeline available under NDA for prospective Enterprise customers.
DPA available
GDPR
A standard data processing agreement is available on request.
Not in scope
HIPAA / FedRAMP
Not in scope today. Talk to us if you need a compliance sponsor on the roadmap.
Need a deeper conversation?
DPA, security questionnaire, architecture review, procurement support.