Security & privacy

Encrypted per team

Every team has its own key (AES-256-GCM), stored encrypted with a master key on the server. Encrypted with the team key: the text and metadata of memories, all their earlier versions, changelog entries and the hook data we keep for rule dry runs.

The server holds the master key, so it can read and write your data. This protects copies of the database (disk, dump), not the running service, and not against us as its operator.

Not encrypted per team

Search needs plain text, so these are stored unencrypted in the database: title, name, type and scope of memories, the words of each memory (search index), its embeddings, triggers (paths, commands, words) and entities. Detected secrets never go into the search index.

Also unencrypted: names of teams, spaces, files and devices, rules and team settings, rule proposals, names and e-mail addresses of members.

Attached files are stored without the team key. Download links are valid for one hour.

Separation between teams

Postgres row level security: every request runs for one team and sees only its rows. Encrypted data is bound to its team: copied into another team, it does not open. Within a team, spaces decide who reads and writes.

Login and devices

Ory Kratos, run by us: code by e-mail, passkey, Google or GitHub, optional one time codes from an app (TOTP). No passwords.

Agents connect with a device token or OAuth. We store only a hash of the token (SHA-256). Device tokens do not expire on their own: revoke them in the team settings under Devices.

Where data lives

On dedicated servers we run at OVH in France: database, files and login. Encrypted backups go to a Hetzner Storage Box in the EU.

Who else processes data

Cloudflare (USA): DNS and proxy in front of mastermem.com and files.mastermem.com. Cloudflare terminates TLS, so all traffic, including what the hooks send, passes through it unencrypted.

Stripe (Ireland): payment, tax and invoices. Brevo (France): e-mails. Hetzner (Germany): backup storage. Google and GitHub: only if you log in with them.

No AI provider: search and embeddings run on our servers. Memories that go into your agent reach its model provider under your contract with them.

What the hooks send

At session start, on every prompt, before and after each tool call and at the end of a turn, the hooks of Claude Code, Codex and Cursor send to mastermem: the prompt text, tool names and inputs (shell commands, file paths, content of written files), the working directory, and the git branch and remote URL (without credentials). Claude Code also sends tool output.

The server uses this to find memories and check rules. It keeps an encrypted selection for 7 days to dry run new rules: prompts only as a set of words, commands, paths and clipped added lines. Session state (which memories were shown, the last prompt) stays in memory only and is gone after a restart or 7 idle days.

Retention and deletion

Hook data: 7 days. Retired memories stay in the history until their space or team is deleted. Deleted spaces can be restored for 30 days, then they are deleted. Deleted teams, and teams 30 days after their subscription ended, are deleted with all memories and files.

Deleting your account removes your login, devices, memberships and private spaces at once; teams with only you in them are deleted as above. What you wrote in shared spaces stays, with the author "Deleted user".

Backups: database dumps stay 14 days on the server. The off site copies keep daily states for 14 days, weekly for 8 weeks and monthly for 12 months, so deleted data can remain in backups for up to a year. The master key is not in the database dumps, but it is in the encrypted backup of the whole server.

Known risks

Prompt injection: memories written by teammates or their agents go into your agent's context. A memory can contain instructions your agent may follow. What exists against it: memory text is marked as data, not instructions; lines that look like mastermem's own output are quoted; always on rules an agent writes stay proposals until a person confirms them; memories containing secrets are refused. This does not stop every attack, so give write access only to people you trust.

If mastermem is down, your agent keeps working without memories and without rule checks.

As operator we can technically read your team's data (see above).

Contact

Security issues and questions: [email protected]