Encrypted AI memory: three readers to check before you trust one
By Matthew Firth, founder of ModelBrain · Oct 19, 2026 · 3 min readMost "encrypted memory" claims close one reader, the vendor's server. Check two more. A saved memory can be read in three places: on the vendor's server, on your own disk, and inside the AI model that receives what is recalled. Here is our own proposal, the three-readers test: for any tool, ask which of the three it closes and which it leaves open.
ModelBrain scored on the three readers, October 19, 2026
| Mode | Vendor's server | Your own disk | The AI model |
|---|---|---|---|
| Local, the default | Closed by absence: no server holds anything and no account exists | Open. Not encrypted at rest. Files are restricted to your operating system user. Use FileVault, BitLocker or LUKS | Open. The assistant receives whatever is recalled, under its provider's terms |
| Sync and managed backup (paid) | Closed. Encrypted on your computer before upload. The key is held by your computers and a 24-word recovery phrase | Open. Same as local, on every computer that syncs | Open, same as local |
| Teams (paid) | Closed. Each shared partition has its own key held only by members' computers. Removing someone changes the key | Open. Same as local, on each member's computer | Open, same as local |
The third reader is open in every mode, by design. A model cannot use a memory it cannot read, so recalled text reaches the assistant you connected. For ChatGPT it also passes through a relay we run, which handles each message in transit and does not store its content. The only way to close the third reader is to run the model on your own computer, and ModelBrain does not control that.
Two details that matter at the second reader
A sync folder can undo disk encryption. Per our security statement, the local program compares its data directory with known sync-folder patterns at startup and refuses to start on a match, because disk encryption does not stop a sync client from uploading the readable view. We are quoting the statement here and did not trigger the check in this test.
Closing the first reader has a cost. If you lose every approved computer and the 24-word recovery phrase, neither you nor we can recover the synced data. A server that cannot read your memories also cannot rescue them.
Three questions to ask any memory tool
Who holds the key to what sits on the server, and can they recover it for you? Is the file on my own disk readable by any program I run, or encrypted? Which text does the model receive when a memory is recalled, and who is the model provider?
What this does not cover
We applied the test only to ModelBrain, and the table comes from our own pages, not a network capture. We do not plan to add vault encryption, because the key would sit on the same computer. For why, see why we did not build vault encryption first, and for what leaves your computer at save and recall time, see what leaves your computer.
Sources
- Security statement v0.4, ModelBrain
- Privacy: local, sync and backup, and Teams, ModelBrain
- Teams: share a partition, ModelBrain docs
Common questions
What does encrypted AI memory mean? It usually means the memory is encrypted before it reaches the vendor's server, with keys the vendor does not hold. That closes one reader. Your own disk and the AI model are separate readers that the claim may not cover.
Can the AI model read my memories if they are end-to-end encrypted? Yes, the ones that are recalled. The tool's server cannot read them if the keys stay on your computers, but the model must receive recalled text to use it, so that reader stays open unless the model runs on your own computer.
Is ModelBrain's local vault encrypted? No. The free local vault is not encrypted at rest, and the files are restricted to your operating system user. Turn on your computer's disk encryption. Sync, managed backup and Teams data are encrypted on your computer before upload.
Last checked October 19, 2026. Settings and tool behavior change often, so confirm a detail on the vendor's own page before relying on it.