Security

Your data security is our top priority

Conteqx uses a privacy-first, zero-knowledge architecture. Your API keys, conversations, and data are encrypted and protected at every layer.

End-to-End API Key Encryption

Your API keys are encrypted using AES-256-GCM before they ever leave your browser. We use a zero-knowledge architecture - we never see, store, or have access to your plaintext API keys.

Local-First Data Storage

Your conversation data is stored locally on your device by default. No conversations are transmitted to our servers unless you explicitly enable cloud sync.

No Data Training

Your conversations are never used for AI model training. We have a strict no-training policy across all AI providers we integrate with.

Password-Protected Encryption

Optionally add a password layer to your encrypted credentials. Even if someone gains access to your device, your API keys remain protected.

Secure Infrastructure

Our infrastructure runs on SOC 2 compliant cloud providers with automatic security patching, DDoS protection, and 99.9% uptime SLA.

Data Residency

All data processing occurs within secure data centers. We support data residency requirements for regulated industries and compliance needs.

How your data flows

Understanding our security architecture helps you trust that your data is always protected.

01

You enter your API key

Your API key is entered in your browser and encrypted immediately using AES-256-GCM before any network request.

02

Encrypted transmission

The encrypted key is transmitted over TLS 1.3 to our secure backend. We never have access to the plaintext key.

03

Direct API calls

When you send a message, your key is decrypted in a secure enclave, used to call the AI provider, and immediately discarded from memory.

04

Response delivery

The AI response is streamed back to your browser over an encrypted channel. Conversation data stays local unless you enable cloud sync.

Our security practices

All data in transit encrypted with TLS 1.3
All data at rest encrypted with AES-256
Regular third-party security audits
Automated vulnerability scanning
Strict access control with principle of least privilege
Incident response plan and 24-hour notification policy
GDPR and CCPA compliant data handling
Regular employee security training
Bug bounty program for responsible disclosure
SOC 2 Type II compliance in progress

Have security questions?

We take security seriously. If you discover a vulnerability or have questions about our security practices, please reach out.

Contact Security Team