mirror of
https://github.com/upstash/context7.git
synced 2026-01-19 10:47:19 +00:00
230 lines
6.8 KiB
Plaintext
230 lines
6.8 KiB
Plaintext
---
|
|
title: Security
|
|
---
|
|
|
|
Context7 takes security and privacy seriously. This page outlines our security practices, data handling, and compliance measures.
|
|
|
|
## Highlights
|
|
|
|
- Queries stay on your device; Context7 only receives derived topics for retrieval
|
|
- Documentation is indexed inside SOC 2 compliant infrastructure operated by Upstash
|
|
- API keys are encrypted, rate limited, and easy to rotate from your dashboard
|
|
- Enterprise customers can enable SSO (SAML, OAuth, OIDC) and receive dedicated audit trails
|
|
|
|
## Privacy-First Architecture
|
|
|
|
### Query Privacy
|
|
|
|
**Your queries never leave your machine.**
|
|
|
|
When you use Context7 through the MCP client:
|
|
|
|
1. Your query is analyzed locally to extract topics and relevant keywords
|
|
2. Only these extracted topics are sent to the Context7 server
|
|
3. Your original query and code remain on your local machine
|
|
4. The server has no access to your actual prompts or conversations
|
|
|
|
<Note>
|
|
The MCP client processes your queries locally and only transmits topic information needed to
|
|
retrieve relevant documentation. Your full prompts, code, and context remain private.
|
|
</Note>
|
|
|
|
### Data Storage
|
|
|
|
**Context7 does not store your source files.**
|
|
|
|
- We only index and store **documentation** and **code examples** from public repositories
|
|
- Your private code, projects, and source files are never uploaded or stored
|
|
- All indexed content is stored in a secure vector database optimized for retrieval
|
|
|
|
**What we store:**
|
|
|
|
- Public library documentation
|
|
- Public code examples from documentation
|
|
- Metadata about indexed libraries
|
|
|
|
**What we don't store:**
|
|
|
|
- Your source code
|
|
- Your queries or prompts
|
|
- Your private repositories (unless explicitly authorized)
|
|
- Your conversations with AI assistants
|
|
|
|
## Infrastructure Security
|
|
|
|
### SOC 2 Compliance
|
|
|
|
Context7 runs on **SOC 2 compliant infrastructure** provided by Upstash.
|
|
|
|
- Type II SOC 2 certified infrastructure
|
|
- Regular security audits and assessments
|
|
- Continuous monitoring and compliance checks
|
|
- Industry-standard security controls
|
|
|
|
### Managed by Upstash
|
|
|
|
Context7's infrastructure is managed by the experienced Upstash team:
|
|
|
|
- 24/7 infrastructure monitoring
|
|
- Automated security patching
|
|
- DDoS protection and mitigation
|
|
- Redundant backups and disaster recovery
|
|
- Enterprise-grade reliability and uptime
|
|
|
|
### Upstash Security Practices
|
|
|
|
All security practices and certificates of Upstash apply to Context7 projects:
|
|
|
|
- **Data Encryption**: Encryption at rest and in transit (TLS 1.2+)
|
|
- **Network Security**: VPC isolation, firewall rules, and network segmentation
|
|
- **Access Control**: Role-based access control (RBAC) and least privilege principles
|
|
- **Audit Logging**: Comprehensive logging of all system activities
|
|
- **Incident Response**: Documented incident response procedures
|
|
- **Vulnerability Management**: Regular security scanning and penetration testing
|
|
|
|
Learn more about Upstash security: [upstash.com/trust](https://upstash.com/trust)
|
|
|
|
## Authentication and Access Control
|
|
|
|
### API Key Security
|
|
|
|
- API keys use cryptographic random generation
|
|
- Keys are hashed and encrypted in our database
|
|
- Keys can be rotated at any time from your dashboard
|
|
- Rate limiting prevents abuse and unauthorized access
|
|
|
|
### Enterprise SSO
|
|
|
|
**Single Sign-On (SSO) is available for Enterprise plans.**
|
|
|
|
Supported SSO providers:
|
|
|
|
- SAML 2.0
|
|
- OAuth 2.0
|
|
- OpenID Connect (OIDC)
|
|
|
|
Enterprise features include:
|
|
|
|
- Centralized user management
|
|
- Team access controls
|
|
- Audit logs for compliance
|
|
- Custom authentication policies
|
|
|
|
Contact our sales team at [context7.com](https://context7.com) for Enterprise plan details.
|
|
|
|
## Data Protection
|
|
|
|
### Privacy by Design
|
|
|
|
- **Data Minimization**: We only collect and store what's necessary
|
|
- **Purpose Limitation**: Data is used only for documentation retrieval
|
|
- **Storage Limitation**: Automated cleanup of outdated data
|
|
- **Transparency**: Clear documentation of what we collect and why
|
|
|
|
### GDPR Compliance
|
|
|
|
For European users, Context7 provides:
|
|
|
|
- The right to access your data
|
|
- The right to delete your data
|
|
- Data portability options
|
|
- Clear consent mechanisms
|
|
- Privacy-first data processing
|
|
|
|
## Rate Limiting and Abuse Prevention
|
|
|
|
- IP-based rate limiting for anonymous requests
|
|
- API key-based rate limiting with tiered limits
|
|
- Automatic detection and blocking of abusive patterns
|
|
- Protection against DDoS and scraping attacks
|
|
|
|
## Secure Development Practices
|
|
|
|
- Regular security code reviews
|
|
- Automated dependency scanning
|
|
- Secure CI/CD pipelines
|
|
- Principle of least privilege for all systems
|
|
- Security testing in development lifecycle
|
|
|
|
## Reporting Security Issues
|
|
|
|
If you discover a security vulnerability:
|
|
|
|
1. **Do not** publicly disclose the issue
|
|
2. Report via [GitHub Security](https://github.com/upstash/context7/security)
|
|
3. Include detailed steps to reproduce the issue
|
|
4. Allow reasonable time for us to address the issue
|
|
|
|
We take all security reports seriously and will respond promptly.
|
|
|
|
## Transparency and Compliance
|
|
|
|
### Open Source
|
|
|
|
The Context7 MCP server is open source:
|
|
|
|
- Code is publicly available on GitHub
|
|
- Community can audit and contribute
|
|
- Transparent implementation and practices
|
|
|
|
Repository: [github.com/upstash/context7](https://github.com/upstash/context7)
|
|
|
|
### Compliance Certifications
|
|
|
|
Context7 benefits from Upstash's compliance certifications:
|
|
|
|
- SOC 2 Type II
|
|
- GDPR compliant
|
|
- ISO 27001 (in progress)
|
|
- CCPA compliant
|
|
|
|
## Best Practices for Users
|
|
|
|
### Secure Your API Keys
|
|
|
|
- Never commit API keys to version control
|
|
- Use environment variables for key storage
|
|
- Rotate keys regularly
|
|
- Use different keys for different environments
|
|
- Revoke unused or compromised keys immediately
|
|
|
|
### Private Repositories
|
|
|
|
For private repository access:
|
|
|
|
- Only grant minimum required permissions
|
|
- Use dedicated API keys for private repos
|
|
- Regularly audit access permissions
|
|
- Consider using GitHub Apps with fine-grained permissions
|
|
|
|
### Network Security
|
|
|
|
- Use HTTPS for all API communications (enforced)
|
|
- Configure proxy settings securely if behind a firewall
|
|
- Monitor API usage for unusual patterns
|
|
- Implement request timeouts and retries
|
|
|
|
## Data Retention
|
|
|
|
- **Library Documentation**: Retained while the library is active and public
|
|
- **API Logs**: Retained for 30 days for debugging and analytics
|
|
- **User Data**: Retained according to your account status
|
|
- **Deleted Data**: Permanently removed within 30 days of deletion request
|
|
|
|
## Questions and Support
|
|
|
|
For security-related questions:
|
|
|
|
- Review our documentation at [docs.context7.com](https://docs.context7.com)
|
|
- Contact us through [GitHub Issues](https://github.com/upstash/context7/issues)
|
|
- Join our [Discord Community](https://upstash.com/discord)
|
|
- Enterprise customers: Contact your dedicated support team
|
|
|
|
For privacy policy details, visit: [context7.com/privacy](https://context7.com/privacy)
|
|
|
|
---
|
|
|
|
**Last Updated**: January 2025
|
|
|
|
We continuously improve our security practices. Check this page regularly for updates.
|