Security at Contextary

Your data's security is foundational to everything we build. Here's how we protect it at every layer.

Last updated: April 26, 2026

Architecture

Architecture and data flow

Multi-tenant cloud architecture with strict isolation, encryption at every layer, and security built into every feature.

Cloud architecture

Contextary runs as a multi-tenant cloud service with strict isolation between organizations. Your data is encrypted, separated from other tenants at the database level, and processed per our Privacy Policy.

Strict multi-tenant isolation
Credentials encrypted at rest (AES-256)
TLS encryption in transit
Managed authentication and session handling
Hosted on AWS infrastructure
Only schema metadata stored — never raw data
Data flow overview
Your AI Tool
Claude, Cursor, etc.
Contextary
MCP Server
Your Warehouse
Schema metadata only

Context flows from your warehouse through Contextary to your AI tools. Raw data stays in your warehouse.

Encryption

Encryption and credential protection

AES-256 Encryption

Warehouse credentials encrypted at rest with AES-256 before storage

Argon2 Hashing

Passwords hashed with Argon2, resistant to GPU and ASIC attacks

TLS in Transit

All communication encrypted with TLS between your browser and our servers

API Tokens

Secure token-based authentication for MCP and API access

Access Control

Access control and isolation

Every layer of Contextary is designed to prevent unauthorized access. Tenant isolation isn't just a policy — it's enforced at the database level and validated with a dedicated test suite.

  • Multi-tenant isolation enforced at the database query level — every query is scoped to your organization
  • Tag-based RBAC — role-based access control with granular permissions per resource
  • Cross-org isolation tests — dedicated test suite that validates no cross-tenant data leakage
  • Session management — 30-day session cookies, revocable at any time by the user or admin
Isolation model
A
Organization A
tables metrics credentials
Isolated — no cross-access
B
Organization B
tables metrics credentials
Application Security

Built-in application security

Security is built into every layer of the application, not bolted on after the fact.

SQL safety validation

Destructive queries (DROP, DELETE, TRUNCATE, ALTER) are blocked by default. AI-generated SQL passes through a validation layer before it can be executed against your warehouse, protecting against accidental data loss.

Rate limiting

API endpoints are rate-limited to prevent abuse, brute-force attacks, and service degradation. Limits are configured per-endpoint to balance usability with security.

Input validation

All user input is validated using Zod schemas on both client and server. This prevents injection attacks, malformed data, and unexpected payloads from reaching the application layer.

CORS configuration

Cross-Origin Resource Sharing is configured to only allow requests from authorized origins, preventing unauthorized third-party sites from accessing the API.

SOC 2 Type II

Planned Certification in progress

Regular security reviews

Periodic internal security audits and code reviews

Responsible disclosure

Report vulnerabilities to security@contextary.ai
Compliance

Compliance and certifications

We are actively building our compliance posture to meet enterprise requirements. Our security practices are designed to align with industry standards, and we are transparent about where we are in the process.

If your organization has specific compliance requirements, please reach out to security@contextary.ai and we will work with your team to address them.

AI Security

AI provider security

You control which AI provider you use and what data they see.

Your API keys

AI queries use your own API keys, stored encrypted at rest. We never have access to your unencrypted keys.

Schema metadata only

Only schema metadata (table names, column names, types) and your annotations are sent to AI providers — not your raw data.

You choose your provider

Contextary supports Anthropic (Claude), OpenAI, and Google (Gemini). You pick the provider that meets your organization's requirements.

Our commitments

What we don't do

Some things are just as important for what we choose not to do.

We don't sell your data

Your data is never sold to third parties. Period.

We don't train AI on your data

Your data is never used to train or fine-tune AI models.

We don't share data between tenants

Cross-tenant isolation is enforced and tested. Your data is yours alone.

We don't store raw query results

Query results are returned to you in real time. We store metadata (row count, execution time), not your actual data.

Questions about security?

We are happy to discuss our security practices, answer questions from your security team, or work through compliance requirements.