We never train on your data. Here's how we protect it.
SOC 2
Same controls on every planEvery plan runs on the same SOC 2 controls for security, availability and confidentiality. SOC 2 certification and reporting come with Enterprise.
HIPAA
BAA on EnterpriseEvery plan runs on the same HIPAA controls. A Business Associate Agreement comes with Enterprise, for teams that handle protected health information.
What a security review usually asks first.
SOC 2 and HIPAA
Every plan runs on the same SOC 2 and HIPAA controls. SOC 2 certification and reporting and a HIPAA BAA come with Enterprise.
Single sign-on
Every plan includes Google sign-in. OIDC single sign-on with Entra ID, Okta or Google Workspace comes with Enterprise.
GDPR-ready
Data export, deletion and portability are supported.
Self-host the knowledge layer
Run the governed knowledge layer on your own infrastructure in Docker, on any cloud or on-premises.
Every read is recorded
Which person or API key, which document, and when, on by default in ContextNest Community.
Built for enterprise workloads from day one.
Cloud infrastructure
Hosted on enterprise-grade cloud infrastructure with automated scaling and redundancy. Hosted data is stored in US data centers.
Encryption
Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). API keys and secrets are kept in dedicated secret stores.
Network security
WAF protection, DDoS mitigation and network isolation, with regular vulnerability scanning and penetration testing.
Your data belongs to you.
No model training on your data
Your prompts, documents and conversations are never used to train models. Prompts go only to the model providers you choose.
Data isolation
Strict tenant isolation keeps each organization's data logically separate. Team-scoped access adds another layer.
Data residency
Hosted data is stored in US data centers. Self-host the governed knowledge layer to keep it on your own infrastructure, wherever that is.
Retention
Set retention for conversations and documents to match your policy, and delete on your schedule. Version history is append-only while you keep it.
Who can see, change and approve what.
ContextNest roles
- OwnerFull control of the nest
- AdminManage people, stewards and settings
- EditorWrite and propose changes
- ReviewerApprove changes before agents use them
- ViewerRead approved knowledge
PromptOwl workspace roles
- OwnerFull workspace control and billing
- EditorCreate and manage agents
- ViewerRead-only access
- UserUse the agents shared with them
When someone asks what happened, there's an answer.
Version history
Every change to governed knowledge is kept, append-only and hash-chained, with who made it and who approved it. Rebuild what any version said on any date.
Read log
Every read is recorded: which person or API key, which document, and when. Owners and admins can review it.
Activity and conversation review
Logins, uploads, agent changes and configuration updates are logged with attribution, retained per your policy. Review AI conversations by team, user or agent.