Encrypted in transit
Laptops and browsers talk to the service over HTTPS only.
Security
Your AI conversations are sensitive. We built for that.
Conversations with Claude contain source code, architecture and sometimes credentials. String Cortex is designed so the right people see them and nobody else.
Tokens as hashes
Each person’s Claude Code token is stored only as a hash and shown once. On the laptop it goes from a form to the plugin, never to Claude, and is masked if it ever appears in a transcript.
Bound to one account
A token works only for the Claude account it was first used with, in your company’s organisation. A copied or reused token stops working, and every push is checked again on the server.
Organisation lock
Only conversations from your company’s Claude organisation ids are stored. Personal accounts are refused.
Strict isolation
Each company’s data is separated and every request is checked against the caller’s company and role.
Secrets masked
API keys, tokens, JWTs, private keys, passwords and credentials in URLs are masked before anything is stored.
Least privilege
Employees see their own conversations and only the projects an admin shares with them through access groups. StringHub staff run the service without seeing any company’s conversations.
Strong logins
Passwords hashed with scrypt, and repeated failed logins are throttled.
Instant off switch
Switch a company off and its laptops stop at once. Its data stays intact until you decide otherwise.
On the laptop
Read-only, quiet and contained
The plugin only reads the transcripts Claude Code already writes. It never edits or deletes them, and it adds nothing to anyone’s projects.
- Its own small folder for state and a log, with the token file readable only by the user
- The server address is set by managed settings and can’t be changed locally
- Tool calls, hidden reasoning and sub-agent internals are not stored, only prompts and replies
| Key | Who handles it | Lifetime |
|---|---|---|
| StringHub login one per person | That person | Until changed |
| Claude Code token one per person and Claude account | That person, pasted once into Claude Code | Until replaced or revoked; renews itself on each use |
| Access token made from it on the laptop | Nobody (renewed automatically) | About an hour |
Your data, your rules
Control where it lives and what is kept
Self-host if you need to
Run the whole stack on your own infrastructure with Docker Compose, including the embedding model.
AI answers only if you turn them on
Search uses an embedding model inside the service and never sends your text out. Ask Cortex is off until your admin turns it on with your own Claude, OpenAI or Gemini key; it then sends only the messages the person asking may see, with secrets masked, to that provider. The key is stored encrypted and never shown again.
Delete what you choose
Remove a session or a whole project from the workspace, and choose whether it may come back on the next sync.
Need a security questionnaire filled in or a deeper review? Contact us.