Risks & trust

Security posture

ContextBrain is built to pass a security review by construction, not by promise. The concrete controls:

• AES-256-GCM at rest — every stored secret (provider API keys, OAuth client secrets, webhook secrets, HMAC secrets) is encrypted at rest. Sessions are HMAC-SHA256 signed.
• RBAC via canPerform — a single source of truth gates every state-changing action against org roles and project roles (PM / Tech Lead / Developer / QA / viewer). Least-privilege is enforced in code, not merely configured.
• 90-day audit log — every state-changing action is recorded, with a secret scrubber on every row that strips key shapes (sk-, ghp_, glpat-, JWTs, Bearer tokens) so secrets never land in an audit trail.
• Prompt-injection delimiters — every user-controlled prompt block is wrapped in delimiters so injected instructions in retrieved content are treated as data, not commands.
• IDOR-safe cross-tenant checks— every project, agent, and squad reference is verified against the caller's tenant, so one organization can never address another's resources. Per-route rate limits and fail-secure webhooks (unsigned deliveries rejected when a secret is configured) round out the perimeter.

IP safety

The single most-cited enterprise fear about AI coding tools is proprietary code leaking into a vendor's cloud. ContextBrain answers it three ways:

• Client-safe context redaction— proprietary code and secrets can be stripped before context is shared with an external AI API, with per-section redaction and severity tagging. An agency can use cloud AI without leaking one client's code into another's context.
• Self-host so code never leaves the perimeter — in self-hosted daemon mode, agent execution, reranking, and embeddings run inside your network. This targets a segment the cloud-only incumbents structurally cannot serve: per the research, GitHub Copilot and Amazon Q Developer are cloud-only and cannot serve air-gapped environments, and on-prem / air-gapped deployment is the primary buying driver in regulated sectors (finance, government, defense, healthcare).
• Bring your own keys — calls go to your provider account under your data agreement, not through a ContextBrain-owned intermediary.

Governance

Memory is powerful precisely because the AI honors it — which makes whatgets remembered a governance question. ContextBrain's three-tier memory promotes findings through a candidate queue, and every promotion runs through a governance scanner that flags risky content and can hard-block it at promotion time (a per-org override). Nothing dangerous gets promoted into the institutional memory silently, and supersedes chains let stale rules age out instead of rotting. See the knowledge graph and context packs for how that memory is assembled and scored.

Compliance

ContextBrain handles GDPR right-to-be-forgotten as a built-in flow: a deletion request enters a 30-day grace window, then purges — anonymizing the user row in place while preserving audit foreign keys so the compliance trail stays intact. Audit retention is 90 days with a nightly purge, and orgs soft-archive (data retained for invoices) rather than hard-deleting history. Read more on the security overview.

Honest limitations

Marketing must never out-run the product, so here is the candid part. ContextBrain makes AI dramatically more grounded. It does not make AI infallible.

• AI still needs human review. ContextBrain closes the loop from issue to pull request and makes every step observable, costed, and audited — but a PR is a proposal, not a merge. The human stays in the loop, and that is by design.
• Retrieval quality depends on fresh indexing. Context is only as good as the index behind it. ContextBrain re-indexes incrementally on every commit and scores packs for freshness so you can see when context is stale — but if an integration is disconnected or a repo never gets connected, the AI cannot reason over what it has not seen.
• It is not a replacement for understanding your system. The goal is to make humans and agents faster on a codebase, not to absolve anyone of understanding it. Treat answers as well-sourced drafts you verify, not verdicts.
• Hallucination is reduced, not eliminated. Grounding a model in the right files, schema, and decisions collapses most guessing — that is the whole thesis — but no context layer can guarantee a model never invents. Every answer cites its sources precisely so you can check the claim against the citation rather than trusting it blind.

The promise is “AI should never work blind,” not “AI is never wrong.” ContextBrain's job is to remove the excuse for guessing — and to make every answer checkable when you choose to check it.

Where to go next

See the full security overview, weigh ContextBrain against the field on Alternatives, or read Cost for how bring-your-own-keys keeps your data under your own agreements.