docsreference
rls everywhere, hashed credentials, optional encryption at rest, full export/delete.
3 pages

privacy & security

Memory is intimate data. The defensive posture is documented in three places: /privacy (policy), /terms, and the public security policy on GitHub — how to report, what's in scope, and the platform posture.

the short version#

  • Row-level security on every table. Cross-user reads are rejected at the database, not just the application.
  • Credentials hashed at rest. OAuth access/refresh tokens and API keys are stored as SHA-256 hashes — a DB dump does not produce usable credentials. API keys are shown once at creation and never again.
  • Service-role behind the auth gate. The MCP and REST routes validate your bearer token application-side, then use a server-only key to call locked-down RPCs. The public anon key cannot read or write your data.
  • Refresh-token rotation with replay refusal. Refresh tokens are single-use (with a 60-second retry grace); replays outside the window are refused.
  • Disclosure classes on Personal Memory. Every Self fact carries private · self · trusted · work · public. self and private cross MCP or the API only to an app the person cleared for them (per app: standard · personal · private, and ask first); by default every app gets the trusted/work/public slice, and every self or private fact that leaves is logged for the person. A person may also let netti shape a few abstract guidance lines from facts an app is not cleared for (off by default): the words never leave, each line is checked in code for anything identifying, and each fact used is logged as abstracted.
  • Grants that end, writes that ask, a receipt for every read. What a person allows an app beyond trusted, work and public can end: for 30 minutes, a day, a week or always, and narrowed to a few categories (how you work · what you like · how you talk · what is on your mind · the people in your life · your body and health). Per app they also set what it may write. By default it writes freely. An app that asks first has its writes about the person, into a project, or a forget held for their yes: the answer is held: true (REST 202), nothing is written until they keep it, so do not send it again. A read-only app's writes answer app_read_only (REST 403) and write nothing. Every response that reads memory leaves the person a receipt: which tool, which projects, pages and categories by name, how much, never a word of what was read.
  • Optional encryption at rest for dimensions, per project, with a passphrase only you hold. We cannot read encrypted content — and if you lose the passphrase, neither can you. We say so before you enable it.
  • Audit log of privileged events on your account. You can read your own log; we cannot edit it.
  • Export and delete are one-click from /account. Deletion is immediate and irreversible; backups purge within 30 days.

what we don't promise#

  • End-to-end encryption through the AI's context window. Once your AI client reads a dimension, the content is in the AI provider's process and possibly their logs. We document this; we can't prevent it.
  • Tamper-evident commits. The commit log is append-only by convention; commits aren't signed today.
  • Multi-region failover. Single region for now.

reporting a vulnerability#

Email yours@innernet.live with "security" in the subject — the full policy lives in the org's SECURITY.md. We triage within 72 hours.