Trust & Security

Nothing is remembered without your yes. What an AI proposes, what the extension captures and what an import extracts all land aspending. A single everyday memory can be approved from the chat when you tell the AI to; we act on the AI's report of that request, because we cannot see the conversation. Anything marked confidential, any batch approval, and any approval that would replace an existing memory cannot be completed by an AI at all: it waits for you to confirm in the app or through the link we email you. A file an AI saves lands as pending too, and is approved the same way as any other memory.

Every retrieval any AI makes from your vault is recorded — which client (as the client names itself when it connects), which tool, which memories, when — and shown on your Activity page. Consent actions are receipted too. If an AI reads three memories at 14:02, you can see exactly that.

Memory text and artifact content are encrypted at rest with an application-layer key (Fernet), on top of provider disk encryption. This protects you against: a leaked database dump, a compromised database account or backup, and any direct read of the raw tables.

It does not protect against:

• a compromise of the API server itself — it holds the key, because it must read memories to embed, search, and serve them;
• embedding vectors, which remain plaintext because similarity search needs them and which can leak semantic information;
• any AI you connect — a model that retrieves a memory necessarily sees its text.

What you type into search is stored sealed, under a key a copy of our database does not contain. Your word index is keyed to this deployment rather than to your vault alone, so a copy of our database shows which of your memories hold which indexed word; sealing that index per vault is designed and measured but not yet switched on.

True end-to-end encryption is structurally impossible for the core feature (an AI answering from your memories must read them). The honest upgrade path is a future zero-knowledge tier with client-side keys, traded against server-side features — we will not pretend otherwise in the meantime.

The operator console we use to run the service shows counts, timestamps, and aggregates — never memory text, artifact content, or the content of your queries. This is enforced in code and covered by regression tests, not just policy.

Forget removes a memory from every retrieval we serve, instantly and on every connector. It waits in Trash for 30 days — restorable if you change your mind — and then the residual encrypted record is hard-purged — leaving only a keyed fingerprint so the deleted item cannot be quietly restored. Vault export is one click, carries every memory, artifact and receipt, with the few internal records we cannot hand back listed in the export itself, and is free forever — leaving must always be easy, or staying means nothing.

The limit, stated plainly: your vault is the origin, and revocation governs the origin and every read after it. Most AI hosts now keep memory of their own, so text one of them has already read may live on in that host's memory, under its controls rather than ours — we will not promise a reach we do not have. The only text certain never to reach a host is text you never allowed, which is exactly what the per-memory allow / ask / blocked setting decides. Claude's own help pages say it plainly: when a conversation is deleted, “related memory entries generated from it won’t be removed” (Anthropic support, fetched 28 September 2026).

Capture happens only on your click. No background watching, no keystrokes, no pages other than the supported AI chats. Site selectors are delivered as data (never code), so fixes for site redesigns cannot smuggle in new behavior.

• OAuth 2.1 with PKCE for every hosted AI connector (a local connector running on your own machine uses no sign-in); the only sign-in-free path is the shared public demo vault, which holds seeded sample content, accepts no conversation imports, and is wiped and reseeded weekly — never put anything private in it.
• Passwords hashed with bcrypt; sessions are signed JWTs.
• Memory content is excluded from application logs by code.
• Migrations are append-only; the codebase and its full history are version-controlled.

Security reports go to contact.ai-pendrive@fenilbuilds.com. We commit to acknowledging within 72 hours and to notifying affected users within 72 hours of any confirmed incident involving their data.