Security

ContextOS is built with security as a default, not an afterthought. Authentication runs through NextAuth with support for email/password and OAuth (GitHub, Google). Sensitive operations, including billing webhooks, use atomic claiming to prevent race conditions and duplicate processing.

Payments

Pro subscriptions are billed via OxaPay using USDT. Payment confirmations use forward-only status transitions, meaning a payment's state can only move forward, never be replayed or rolled back by a stale webhook.

Rate limiting

API routes are protected by Redis-backed rate limiting to prevent abuse, with limits tuned per endpoint.

Data

Project data is stored in a managed Postgres database (Neon) hosted in the US (Oregon region), private to your account and served over HTTPS. Deletion on AI-related routes uses soft-delete first to prevent accidental data loss, and data export is available on the Pro plan. See the privacy policy for details on what's collected.

AI features

AI resume and next-step briefings are generated on demand from your own project data and returned only to you. Your data is not used to train AI models.

Frequently asked questions

Yes. Authentication runs through NextAuth (email/password plus GitHub and Google OAuth), all traffic is served over HTTPS, API routes are rate-limited, and billing webhooks use atomic claiming with forward-only status transitions.

In a managed Postgres database (Neon) hosted in the US (Oregon region), private to your account.

Yes. Export is available on the Pro plan, and you can delete projects at any time. Deletions on AI-related routes use soft-delete first to prevent accidental loss.

No. Pro is billed in USDT via OxaPay; ContextOS never handles card numbers or bank details — only the payment confirmation webhook.

No. AI resume and next-step briefings are generated on demand from your own project data and returned to you; your data is not used to train models.