Get started
Security

Security

How ContextQ protects your data. Built for teams with compliance requirements.

  1. 01

    Data Isolation

    Multi-tenant architecture with Row-Level Security (RLS) in PostgreSQL. Each tenant's data is strictly isolated at the database layer using tenant_id policies. No cross-tenant data leakage is possible — queries are automatically scoped to the authenticated tenant, enforced by PostgreSQL itself.

  2. 02

    Encryption

    All traffic is encrypted in transit with TLS. Secrets you hand ContextQ — third-party provider API keys (bring your own key), webhook signing secrets and connector credentials — are encrypted with AES-256-GCM before they are stored, and backups are AES-256-GCM encrypted.

    Note

    Context content is protected by tenant isolation and access control; it is not encrypted with per-tenant keys. Do not store secrets such as passwords or API keys in context entries.

  3. 03

    Authentication

    • JWT tokens — httpOnly cookies with short expiry for dashboard sessions. Tokens are not accessible via JavaScript.
    • API keys — Bearer tokens for programmatic access. Keys are stored only as SHA-256 hashes; plaintext is shown only once at creation.
    • Password storage — No passwords stored in plaintext. All passwords are hashed with bcrypt using an appropriate cost factor.

  4. 04

    Infrastructure

    • Marketing site hosted on Cloudflare Pages. API and database on dedicated VPS infrastructure.
    • PostgreSQL 17 with encrypted connections.
    • Elasticsearch 8.17 with TLS.
    • All traffic over HTTPS / TLS 1.2+.

  5. 05

    Responsible Disclosure

    If you discover a security vulnerability, please email security@contextq.dev. We aim to respond within 48 hours. No bug bounty program currently, but we acknowledge all valid reports.

  6. 06

    Compliance

    GDPR-aware data handling. Users can request full data export or deletion at any time. Our Privacy Policy governs data retention and processing. We do not sell or share your data with third parties.