Agentic dev your security team approves.

OAuth tokens encrypted with AES-256-GCM at rest. API tokens HMAC-SHA256 hashed; the raw value is shown once at mint time. Sessions signed and HTTPS-only.

• AES-256-GCM for OAuth tokens (Phase 2)
• HMAC-SHA256 for API + chat-share tokens (Phase 1 + 6)
• HttpOnly, signed session cookies

Granular permissions per role at every layer. Per-document audience scoping. Defense-in-depth: retriever filters AND retrieval weights of 0.0 — redundant denial means a misconfigured filter still doesn't leak.

• Phase 18 role-aware retriever
• Per-source audience: internal / client / hybrid
• Embed surface clamps role to client server-side

Every action logged with actor, action, metadata, and IP. CSV export streams chunked for arbitrarily large windows. PII redaction masks AWS / Anthropic / GitHub / OpenAI keys automatically.

• Streaming CSV export from /admin/settings/audit
• Auto-redaction on credential-shaped strings
• Retention configurable per org

OpenAI / Voyage for embeddings · Anthropic for agents. No data flows through ContextBrain's accounts when BYOK is enabled. Per-org configurable. Swap providers any time.

• Phase 4 embedding-provider abstraction
• Phase 7 LLM-provider abstraction
• Rotate keys without re-indexing

One Docker compose for the whole stack. Postgres-native — no separate vector DB or graph DB to operate. No third-party telemetry. Runs offline. Apache-2.0 core.

• docker compose up — Postgres + Next.js + workers
• Same code as the SaaS
• Optional paid support add-on

Active engagement with Drata / Vanta-equivalent. Public trust portal coming. Customer-pre-bound NDA + redacted summary available on request during evaluation.