Account access
Sign in with Google or email + password. Passwords are stored only as salted hashes, and sign-in/sign-up are rate-limited to resist abuse.
Private by default
Your sessions and files are visible only to you — sharing is opt-in, per item.
No training on your data
Cortexa does not use your research content or files to train models.
API keys
Keys authenticate the OpenAI-compatible API, native agent streaming, and MCP traffic. The value is shown once; Cortexa stores only a hash.
Revocation is shared
Revoking a key disables it everywhere — API clients, MCP desktop configs, remote MCP clients, and any automation using that token. Name keys per client or environment so you can revoke precisely.
Your research data
It's easiest to reason about the model by separating source material, generated artifacts, and operational metadata.
Uploaded files
Private to you unless you explicitly share them with an org workspace.
Generated outputs
Briefs, decks, analysis, and citations follow the same visibility rules.
Usage metadata
Enough to support billing, abuse prevention, debugging, and admin visibility.
Research disclaimer
Research context only — not medical, legal, financial, or regulatory advice.
Encryption & deletion
Your data is encrypted in transit and at rest, and you can delete your account on your own terms.
Encryption
TLS 1.2+ in transit; encrypted at rest.
Delete your account
Schedule deletion in Settings → Account; erased within 30 days after a recovery window.
What deletion removes
Cascades across sessions, files, artifacts, usage, and payment identifiers.
Compliance & regulated data
What Cortexa offers today — stated plainly, with no over-claiming.
HIPAA / PHI
Not HIPAA-covered by default. No PHI without a BAA; de-identify for research.
GDPR & CCPA
Data-subject rights incl. access and deletion — support@cortexa.sh.
Enterprise reviews
Security reviews, a BAA, or compliance questions: contact support.
See also
Full legal terms live in our Privacy Policy and Terms of Service.