Enterprise-Grade Security
Security, Privacy & Compliance
CortexaOS is built for businesses that handle sensitive data. Here is exactly how we protect yours.
AES-256
Encryption at Rest
TLS 1.3
In Transit
RBAC
Role-Based Access
US
Data Residency
Data Security
- AES-256 encryption at rest on all stored data
- TLS 1.3 in transit for all API and dashboard traffic
- HTTP-only, SameSite cookies for session management — no localStorage tokens
- Field-level encryption for the most sensitive records via AES-256-GCM
- Vercel Edge Network with DDoS protection and WAF
Compliance
- Audit logs of sign-ins, security changes and staff access that cannot be edited or deleted
- US customers only — all data is stored in the United States
- Export and delete your data on request, at any time
- SOC 2 Type II — preparation in progressIn Progress
Access Control
- Role-based access control (RBAC) — Owner, Admin, Member and Viewer roles
- Multi-tenant isolation — teams cannot access each other's data
- JWT sessions with 24-hour expiry, auto-refresh on activity
- Rate limiting on all API endpoints (Upstash Redis-backed)
- Inactivity timeout configurable per account
Responsible AI
- Anthropic does not train models on your data. Their standard retention for abuse monitoring is 30 days.
- All AI requests are processed through the Anthropic API
- Company Brain data stored encrypted in your team's isolated namespace
- BYOK (Bring Your Own Anthropic API Key) available — your key, your data
Reliability
- Hosted on Vercel Pro with global edge network
- Neon serverless Postgres with automatic backups and point-in-time recovery
- Vercel Analytics and Speed Insights active on all pages
Reporting a Vulnerability
- Responsible disclosure: security@cortexaos.ai
- We aim to acknowledge reports within one business day and treat critical vulnerabilities as our top priority until they are fixed
Security is not a feature. It is the foundation.
Every layer of CortexaOS is built with security-first principles — from database encryption to session management to AI data handling. We do not cut corners so you can run your business with confidence.
Questions about security?
Our team is happy to walk you through our security architecture, compliance posture, and data handling practices.
To report a vulnerability, email security@cortexaos.ai