TRUST CENTER

Local-first trust you can defend in a pilot

Enterprise buyers need proof before APIs. Local-first architecture, human Gates 1 & 2, optional shared-server OIDC, and operator audit trails — the trust layer behind v1.0. Blast-radius SKU and SOC 2 certification remain on the roadmap.

Local-first architecture

Code indexing, embeddings, and retrieval run on your infrastructure. Ollama processes locally — source never required to leave your device on the Developer tier.

Human verification gates

Context Lens before inference. Patch preview and apply gates before repo writes. AI narrates; humans approve material changes. Graph-computed blast radius and drift SKUs are roadmap — not the August GA package.

RBAC & agent governance

Role-based access for humans; planned scoped read tools for MCP agents on the Verification Engine roadmap. v1.0 enforces human Gates 1 & 2 in the IDE — no silent writes.

Audit trail

Operator actions and support-bundle exports for pilot and security reviews. SOC 2 Type II certification and dedicated evidence collectors are on the Track B roadmap — not claimed as achieved.

Optional cloud (BYOK)

Cloud LLM routing is opt-in and disabled by default. Provider API keys live in VS Code secrets on the developer machine — never in server config. Assembled context is redacted before any approved cloud dispatch. Local Ollama remains the default for sovereign workflows.

Deployment models

ContextMint supports two architectures. The default v1.0 path is local-first. Shared on-prem server mode is available for guided regulated pilots with platform engineering support.

Local-first (default)

ContextMint Engine on each developer machine runs the API server and Ollama. The VS Code extension connects to localhost:8000. Indexing, embeddings, and inference stay on the workstation — the path v1.0 is built for.

Ready for pilot · sovereign · no shared server required

Sovereign on-prem API (pilot)

A customer-hosted API server stack (Docker Compose) with OpenAI-compatible inference (typically vLLM), Chroma, Redis, and OIDC. Developers point the extension at ContextMint.serverUrl — this is not the Engine desktop tray, and it is not “enterprise = Ollama on a shared box” as the only story.

Design-partner / pilot · ops setup required · Sovereign server guide

Sovereign server — what works today

The server indexes filesystem paths it can read. The extension registers the open workspace path with the server. These patterns work for on-prem pilots:

  • VS Code Remote SSH — workspace path is on the same host as the API server
  • Shared monorepo on a mounted volume — server indexes the mount; developers use matching paths
  • Dev VM or build agent — code and ContextMint API co-located on one machine
  • OIDC / SSO — extension enterpriseMode forwards Bearer tokens; server validates JWT issuer and audience
  • HTTPS ingress — nginx + TLS in front of the API (Docker / Helm templates provided)
Important limitation

Pointing a laptop with a local-only clone (e.g. C:\dev\repo) at a remote corporate server URL does not work out of the box — the server cannot read paths that exist only on the developer machine. Platform teams must align repo location, mounts, or Remote SSH before indexing. We help teams validate this during the design partner evaluation pilot (see Design Partners).

Enterprise controls

  • SSO via OIDC on the shared-server pilot path (Microsoft Entra ID, Okta, Keycloak, and other compliant IdPs)
  • Role-based access — viewer, dev, admin per workspace (shared-server path)
  • Self-hosted API server — Docker Compose or Helm for regulated pilots
  • Optional BYOK cloud routing with egress redaction (off by default)
  • Operator audit / support-bundle export; Redis-backed rate limiting on team server
  • Air-gapped Helm, tenant isolation, and fabric evidence ledger — roadmap / packaging

SOC 2 Type II and formal compliance packaging are on the Track B roadmap. Shared-server auth hardening and path alignment are part of the regulated pilot path — design partner intake opens by start of September 2026.

Need a security questionnaire or architecture review for local-first vs shared-server deployment?

Request security briefing Sovereign server guide Getting started

Website accessibility: WCAG 2.2 AA statement