Security & privacy¶
A customer-facing summary of what CortexBuild sends, stores and protects. This is not the full internal security and privacy pack — if you need that level of detail (data-flow diagrams, retention schedules, sub-processor list), ask your CortexBuild contact.
What leaves your machine¶
| Destination | Data | Trigger |
|---|---|---|
license.cortexbuild.dev |
Licence activation/refresh requests; telemetry events (event names, counts, ids — never code, prompts, file contents or secrets) | Activation, lease renewal, and normal CLI use once a collector is configured |
dist.cortexbuild.dev |
Nothing you send — this is the package index CortexBuild installs and upgrades from | Install / upgrade |
| Your configured model provider | Only when you explicitly opt in to CortexBuild's own orchestrator (CORTEXBUILD_LLM=1); the prompt is redacted first (see below) |
An orchestrator run you started, never a background process |
Telemetry records counts, names and ids only — never source code, AI prompts, file contents, credentials or personal data. If no collector is configured, telemetry stays in a local ledger on your machine and nothing is sent anywhere.
Model calls go through one redaction choke-point¶
Every call CortexBuild's own orchestrator makes to a model provider is routed through a single wrapper, never a raw provider client. Before a prompt can reach a provider, it is run through a detector that finds and replaces secret-shaped content — API keys, tokens, connection strings, private keys, emails, IP addresses, internal hostnames, and absolute paths containing a username — with a stable placeholder. This applies regardless of which provider you configure, and it sits on top of (not instead of) the fact that the orchestrator sends nothing anywhere unless you have explicitly opted in.
Rule text follows the same principle from the other direction: only your own project's and your organisation's rules are eligible to leave by default. Anything adopted from elsewhere, imported, or unclassified is treated as proprietary and stays local.
Local-only and air-gapped operation¶
Most of CortexBuild's pipeline — repository analysis, rendering rules into
your AI tools, conformance scoring, the recurrence ledger — runs with no
model at all and touches only your own filesystem. If you do configure a
model, locality: local (a loopback endpoint such as Ollama or LM Studio) or
locality: self_hosted_lan keeps inference on hardware you control. See
Configure your model and
Install options & licensing
for the offline/air-gapped installation path — CortexBuild is offline-by-default,
so this is a supported install shape, not a workaround.
Credentials¶
Provider API keys are referenced by environment variable name
(api_key_env: ANTHROPIC_API_KEY), never written inline into a config file.
A config carrying what looks like an inline secret is rejected at parse
time rather than silently accepted. Your admin-portal login and licence
activation tokens are yours to hold; CortexBuild's service stores only a
one-way hash of an activation token, so it cannot be recovered or displayed
again after issuance — only rotated.
Organisation isolation in the portal¶
You only ever see your own organisation's data in the admin portal. This is enforced at the database layer, not just by hiding buttons in the UI — a request naming another organisation's licence or project returns "not found" rather than an error that would confirm it exists.
Tamper evidence¶
CortexBuild ships integrity tooling you can run yourself: cortexbuild
integrity checks the packaged rules and templates against known-good
signatures, and cortexbuild git paths --verify checks that a governance
change (a rendered file, a rule pack) has not been altered outside the
expected commit set. Both are read-only checks you run on demand.
Data-subject requests¶
If you need to access, export or delete personal data CortexBuild has processed on your behalf, start with your organisation's admin (the admin portal has a dedicated screen for this) or contact CortexBuild directly.
Need more detail?¶
This page is deliberately a summary. For a data-flow diagram, sub-processor list, retention schedule, or anything needed for a security questionnaire or DPA review, ask your CortexBuild contact for the full security and privacy pack.
Next¶
- How it works — the mechanism this page assumes.
- Help — FAQ and troubleshooting.