API keys are stored hashed
We keep a hash plus the prefix and last four characters. The plaintext is shown once at creation and cannot be recovered afterwards.
Security
What is protected, and what is not claimed
Contexta is a small product on infrastructure we operate. This page is deliberately specific about both halves of that sentence.
In place today
Row-level security on the database
Postgres policies scope rows to the authenticated account, so a token for one workspace cannot read another's documents, subscriptions or notifications.
Quotas on every paid path
Per-minute and per-day request limits per key, plus a daily budget on chat answers and document briefs. Rejections return 429 with a reason and are logged.
Scoped keys
A key can be limited to a subset of documents. Requests for material outside the subset return empty results, and exports answer 404.
TLS everywhere, audited API traffic
The web app is served over HTTPS and the API terminates TLS in front of the service. API calls are logged with the response status and pruned after 90 days.
Authentication through Supabase Auth
Tokens are verified against the provider's keys, email addresses must be verified, and Google sign-in is optional alongside email and password.
What we cannot promise
- No SOC 2, ISO 27001 or similar certification, and no third-party penetration test on record
- Answering a question sends the retrieved text to a third-party model (DeepSeek, and an OpenRouter model for embeddings); we do not use your documents to train anything, but the text does leave our infrastructure to produce an answer
- Account deletion removes your workspace data; legal holds and the 90-day API log window are stated on the GDPR page rather than hidden
Reporting a problem
Use the routes on the contact page and include the smallest request that reproduces it. There is no bug bounty and no signed disclosure agreement yet — we would rather say that than imply a programme we do not run.
Contact options