Written for whoever has to approve installing this. It describes the product as it exists today, pre-release. Where something is designed but not built, it says so rather than implying coverage, and it names what is deliberately not protected.
Process. A local daemon holds exclusive write ownership of the vault and exposes exactly one Unix domain socket. Callers are authorized by the OS peer-UID check. The local product opens no network listener.
Model. The MCP client forwards five tool names — remember, recall, forget, expand, connector_sync — and nothing else. Administrative operations are unreachable over MCP, which protects against a naive or buggy host as well as a hostile one.
Human. Adding an ingestion root requires an interactive terminal on that machine and ships with no --yes or --force flag. Backup destinations and peer authorization follow the same rule: proposed anywhere, effective only locally.
visibility is a narrow enum in the record header, never derived from model-writable content. Connector provenance — source_uri, sync_connector_id, ingestion parent_id — is written at ingestion and is not model-writable. Records carry a checksum that the read path validates, so silent corruption surfaces as an error rather than a plausible answer.
Deletion is a tombstone plus exclusion from retrieval, made permanent by compaction. forget on the head of a version chain reverts to the previous version; on connector content it tombstones the whole source, resolving a child target to its root first. Deletion integrity — that forgotten content stays out of every later recall, including after compaction and a restart — is a hard-fail line in the published evaluation, not a scored metric.
No application-level encryption at rest. The read path maps segments directly for zero-copy traversal; encrypted bytes cannot be read that way without a second buffered path and OS-keychain key management, neither of which exists. Mitigation is full-disk encryption (FileVault, BitLocker, LUKS). Stated here rather than omitted.
The on-disk format is proprietary, which is not a security property. A shipped binary can be reverse-engineered.
Cloud-sync guard. The daemon compares its data directory against known sync-folder patterns at startup and refuses to start on a match, because disk encryption does not prevent a sync client from uploading the decrypted view.
In transit: local traffic never leaves the socket. Managed backup is encrypted client-side before upload, with the key held by the client. Server-tier client connections are designed as TLS with API-key or client-certificate authentication.
Server-tier authorization is unresolved. Client authentication is designed; the role and access-control model that decides what a valid credential may read is not. The tier does not ship until it exists.
Atomicity of multi-record operations. Ingestion, version-edge creation, subtree tombstones and chain reverts need a defined unit of atomicity in the storage engine. Open, tracked, and a prerequisite for release.
Second-writer races. Background housekeeping moves and rewrites blocks. Its publication must be serialised through the single writer; until that is implemented, concurrent-writer races are a known risk rather than a solved problem.
No third-party audit, no bug bounty, no certifications. There is no SOC 2 report and we will not imply one. Report issues to security@modelbrain.net; we aim to acknowledge within three working days and to publish fixes in the changelog.