Trust & Security

Nothing is remembered without your yes. Machine-extracted memories always land as pendingin a Review Inbox — in the app, the browser extension's side panel, or via chat — and only your explicit action activates them. Bulk approvals from a chat AI are two-phase: the AI must show you a preview, and only a cryptographically signed confirmation token (bound to you, the action, and the exact items, valid five minutes) can commit.

Every retrieval any AI makes from your vault is recorded — which client, which tool, which memories, when — and shown on your Activity page. Consent actions are receipted too. If an AI reads three memories at 14:02, you can see exactly that.

Memory text and artifact content are encrypted at rest with an application-layer key (Fernet), on top of provider disk encryption. This protects you against: a leaked database dump, a compromised database account or backup, and any direct read of the raw tables.

It does not protect against:

• a compromise of the API server itself — it holds the key, because it must read memories to embed, search, and serve them;
• embedding vectors, which remain plaintext because similarity search needs them and which can leak semantic information;
• any AI you connect — a model that retrieves a memory necessarily sees its text.

True end-to-end encryption is structurally impossible for the core feature (an AI answering from your memories must read them). The honest upgrade path is a future zero-knowledge tier with client-side keys, traded against server-side features — we will not pretend otherwise in the meantime.

The operator console we use to run the service shows counts, timestamps, and aggregates — never memory text, artifact content, or the content of your queries. This is enforced in code and covered by regression tests, not just policy.

Forget removes a memory from every retrieval we serve, instantly and on every connector. It waits in Trash for 30 days — restorable if you change your mind — and then the residual encrypted record is hard-purged. Vault export is one click, complete, and free forever — leaving must always be easy, or staying means nothing.

The limit, stated plainly: your vault is the origin, and revocation governs the origin and every read after it. Most AI hosts now keep memory of their own, so text one of them has already read may live on in that host's memory, under its controls rather than ours — we will not promise a reach we do not have. The only text certain never to reach a host is text you never allowed, which is exactly what the per-memory allow / ask / blocked setting decides.

Capture happens only on your click. No background watching, no keystrokes, no pages other than the supported AI chats. Site selectors are delivered as data (never code), so fixes for site redesigns cannot smuggle in new behavior.

• OAuth 2.1 with PKCE for every AI connector; the only sign-in-free path is the shared public demo vault, which holds seeded sample content, accepts no conversation imports, and is wiped and reseeded weekly — never put anything private in it.
• Passwords hashed with bcrypt; sessions are signed JWTs.
• Memory content is excluded from application logs by code.
• Migrations are append-only; the codebase and its full history are version-controlled.

Security reports go to contact.ai-pendrive@fenilbuilds.com. We commit to acknowledging within 72 hours and to notifying affected users within 72 hours of any confirmed incident involving their data.