Other Resources Copy

Security, Privacy & Compliance

Enterprise security standards, automated PII & secret scrubbing, tenant data isolation, and regulatory compliance frameworks.

BetterContext is engineered from the ground up for zero-trust enterprise environments. We ensure that proprietary intellectual property, customer records, and internal codebase architectures remain strictly protected.

FRAME 01 · CLIENT ENVIRONMENT & LOCAL REGEX HARNESS 01 · Local Harness Workstation & CI Runner Client-Side Regex Scrub Pre-Egress Token Mask Synthetic Placeholders LOCAL Client-Side Data Perimeter • High-entropy regex strips API keys & JWTs • Sensitive PII replaced with synthetic tokens • Zero Unencrypted Raw Outflow mTLS 1.3 FRAME 02 · TRANSPORT GATEWAY & TENANT NAMESPACE VAULT 02 · Ingress Gateway Enforced TLS 1.3 / mTLS Least-Privilege Scopes Anti-Replay Nonce Guard Rate & Anomaly Shield mTLS 1.3 03 · Tenant Vault Cryptographic Partition AES-256 Volume Storage AWS/GCP KMS (BYOK) Zero Cross-Tenant Leak AES-256 OPT-OUT FRAME 03 · MODEL EGRESS & NON-TRAINING PERIMETER 04 · Model Egress Contractual Non-Train SLA Zero Data Retention (ZDR) Stateless Ephemeral Egress SOC 2 Type II Sandbox NO-TRAIN Zero-Retention Guarantee • Explicit non-train headers sent to model APIs • In-flight buffers purged immediately on exit • 100% SOC 2 Type II Compliant Sandbox Continuous Cryptographic Audit Logging & Proof

Zero Model Training Guarantee

BetterContext operates under a strict, contractual zero-data-retention and zero-training policy:

Data Sovereignty Commitment:
• Never Trained On: Your proprietary code, embeddings, documentation, and agent queries are never used to train public or private LLMs.
• Tenant Isolation: Each customer operates within an isolated database schema with tenant-specific encryption keys.
• Opt-Out by Default: All API calls and MCP interactions carry explicit non-training headers across all upstream model providers.

Automated Secret & PII Redaction

Before text is passed to any AI model or indexed into the graph, BetterContext's local scanner automatically identifies and redacts sensitive tokens:

  • Developer Secrets: API keys (AWS, Stripe, OpenAI, GitHub), private SSH keys, database connection strings, and JWT tokens are replaced with synthetic placeholders.
  • Personal Identifiable Information (PII): Email addresses, phone numbers, credit cards, and social security identifiers are scrubbed locally.
  • Configurable Regex Rules: Security teams can inject custom proprietary regex patterns for internal project codes.

Encryption Standards & Key Management

Data is protected at all stages:

State Standard Implementation Details
Data in Transit TLS 1.3 / HTTPS Enforced cipher suites with forward secrecy; HTTP automatically redirects to HTTPS with HSTS.
Data at Rest AES-256 / XTS Encrypted volume storage across all database clusters, vector indices, and graph caches.
Customer Keys (BYOK) AWS KMS / GCP KMS Enterprise customers can bring their own encryption keys for remote cryptographic envelope control.

VPC & Air-Gapped Deployments

For organizations with strict data residency regulations (defense, healthcare, finance), BetterContext can be deployed within your private Amazon Web Services (AWS), Google Cloud (GCP), or Azure VPC via Kubernetes Helm charts with zero egress connectivity.

Next Steps

Was this page helpful?

Powered By BetterContext