Public security overview · reviewed August 21, 2026
Personal memory deserves visible boundaries.
Security at hippocampOS starts with a product promise: you choose what enters a brain, the system keeps recall inside the scope you selected, and deletion removes the machinery behind that memory, not merely its screen.
Trust check
What you can verify before you pay.
Trust starts with an accurate answer, including when the answer is not yet. These are the current product and infrastructure boundaries, not promises for a future roadmap.
Encryption
Active database storage is encrypted at rest.
Public traffic uses HTTPS. The active production database, automated backups, and new recovery snapshots are encrypted at rest with a customer-managed key, and database clients verify server identity during encrypted connections. Connector credentials and object storage keep their service-specific protections.
AI training
We do not train generalized AI models on Google user data.
Selected content may be sent to the AI provider you configure only to deliver requested hippocampOS features. That provider's own terms and data controls also apply.
Deletion
Delete removes active product data in scope.
Deleting an eligible brain removes its hippocampOS content, credentials, and processing work. A verified account-deletion request removes or de-identifies active user-scoped records, subject to narrow security, legal, and transaction retention needs.
Portability
Markdown export is not available yet.
We do not advertise portability as shipped until a verified export path exists. This page will change when an account or brain export is available in the product.
01
You choose every source
Nothing is connected silently. You authorize each connector, select its brain, and decide when a source should sync.
02
Recall stays in scope
A normal search is constrained to your account and selected brain. Cross-brain recall happens only when you choose Master Brain.
03
Credentials are protected
Connector credentials stay on the backend, protected from browser access, and OAuth handoffs are bound to the signed-in user.
04
Removal follows provenance
Brain deletion clears its full scope; an audited connector rebuild removes only that connector's contribution and preserves evidence still supported elsewhere.
Protection should be something you can use.
The most important security decisions appear as normal product choices: which provider to connect, which brain receives it, whether a sync runs, which brain is invoked, and when data should be removed.
A source opens only after you say yes.
- Gmail access is read-only; hippocampOS cannot send, edit, or delete your email.
- Google Photos uses the Picker permission, so only media you explicitly select is imported.
- Freeform, ChatGPT Memory, and Claude Memory process only the text or files you submit.
- Connector authorization is tied to the active account and selected brain; callback state is signed and verified.
The server decides who you are.
- Private pages require an authenticated Clerk session.
- The backend validates session tokens and restricts accepted application origins.
- Tenant and user identity are derived on the server, not accepted from browser-supplied form fields.
- Administrative routes perform a separate privilege check rather than relying on a hidden link.
Brains are retrieval boundaries.
- Memory, facts, beliefs, graph traversal, and source fetches are filtered by tenant and owner.
- Brain-scoped requests add the graph identifier before candidates are ranked or assembled into context.
- A Master Brain query is an explicit aggregate mode, not a silent global search.
- Ownership checks also apply when an AI client fetches a specific MCP result by ID.
Secrets are not ordinary profile fields.
- Notion tokens and connector API keys are encrypted with AES-256-GCM before storage, including integrity authentication.
- MCP client secrets, authorization codes, access tokens, and refresh tokens are stored as hashes rather than reusable plaintext.
- OAuth redirect URIs and return URLs are validated to prevent an authorization result being sent to an unapproved destination.
- Application secrets remain on the backend; the frontend has no database, queue, or secret-store access.
The boundary travels with the data.
Source identity and brain ownership are carried from collection into processing, recall, and deletion. Independent evidence identities also prevent a retry from being counted as a new source. These are not labels added after the system has already mixed everything together.
Step 1
Connect
You see the provider, requested capability, and destination brain before authorization begins.
Step 2
Collect
The service fetches only what the connector permission permits and records source identity for provenance and cleanup.
Step 3
Process
Jobs carry tenant, user, brain, and connector context. Inputs are validated and user-facing rich text is sanitized.
Step 4
Recall
Search and MCP tools apply ownership and brain scope before private context can be returned.
Step 5
Delete
Brain deletion clears associated records and queued work; an admin connector rebuild removes only the selected source contribution before fetching or reprocessing it again.
MCP is a narrow door, not a master key.
Connecting an AI client gives it a deliberately small memory surface. It does not expose the admin console, billing, connector credentials, worker controls, or arbitrary database access.
Two scopes
MCP exposes only brains:read and search:read.
Four tools
Clients can list brains, search, fetch a result, and invoke a brain, with no administrative access.
OAuth bound
Authorization is linked to the signed-in tenant and user, with PKCE support and expiring credentials.
Auditable
Authorization and invocation activity is recorded with client, owner, scope, and outcome context.
Quiet controls behind every screen.
Public traffic uses HTTPS. The production database is not publicly reachable, and the browser communicates with data services through authenticated backend routes rather than direct database or queue connections.
Content Security Policy, clickjacking protection, MIME sniffing protection, a restrictive referrer policy, and browser permissions policy reduce common web attack paths.
Allowed frontend origins are restricted at the API boundary. Private responses use private or no-store cache rules where sensitive state must not be shared.
Request identifiers, MCP audit records, job outcomes, and health checks make failures and suspicious access diagnosable without exposing secret values in the interface.
Product analytics use explicit events, opaque account and workspace identifiers, normalized paths without query strings, and bounded properties. PostHog autocapture and session replay are disabled.
Production uses durable, isolated job queues and dead-letter queues for background work. Redis provides an encrypted high-availability control plane, while a legacy unencrypted Redis node remains a tracked removal dependency.
The active production database is private and encrypted at rest with a customer-managed key. Automated backups and new recovery snapshots are encrypted, database clients verify server identity during encrypted connections, 14-day point-in-time recovery and deletion protection are enabled, and older pre-migration snapshots remain tracked for retirement.
AI receives context for a job, not ownership of your life.
- Selected content may be sent to configured AI providers only to deliver hippocampOS features such as extraction, summarization, and search.
- Google user data is not used for advertising, resale, surveillance, credit decisions, or training generalized AI models.
- Provider and model selection is visible in product settings where configuration is available.
- Derived facts preserve source provenance so important answers can be checked against the underlying record.
Trust also means saying what we do not claim.
This is an implementation overview, not a certification badge. We will update it as the product, infrastructure, and independent assurance program evolve.
- We do not claim that any internet service can provide perfect security.
- We do not claim end-to-end encryption: hippocampOS must process authorized content to build and retrieve memories.
- We do not claim universal encryption at rest. The active production database and its current recovery path are encrypted, but older pre-migration snapshots remain temporarily retained under restricted access until approved retirement.
- We are not currently presenting SOC 2, ISO 27001, or an independent penetration-test certification on this page.
- AI-generated summaries and facts can be wrong. Important decisions should return to the linked source evidence.
Security should be discussable.
Report a security concern or ask how a specific feature handles your data. Please do not include passwords, access tokens, or sensitive source content in the first message.