Written for whoever has to approve installing this. It describes the product as it exists today, in beta. Where something is designed but not built, it says so rather than implying coverage, and it names what is deliberately not protected.
Process. A local daemon holds exclusive write ownership of the vault and exposes exactly one local socket (a Unix domain socket on macOS and Linux, a named pipe on Windows). Callers are authorized by an OS peer-identity check. The local product opens no network listener.
Model. The MCP client forwards a fixed set of fourteen tool names and nothing else: remember, recall, forget and expand; list_memories; six partition tools; and three read-only checks, diagnostics, usage and ping. Administrative operations are unreachable over MCP, which protects against a naive or buggy host as well as a hostile one.
Human. Adding an ingestion root can only be done locally, from the menu's folder picker or an interactive terminal, never over MCP, and ships with no --yes or --force flag. Backup destinations and peer authorization follow the same rule: proposed anywhere, effective only locally.
visibility is a narrow enum in the record header, never derived from model-writable content. Connector provenance (source_uri, sync_connector_id, ingestion parent_id) is written at ingestion and is not model-writable. Records carry a checksum that the read path validates, so silent corruption surfaces as an error rather than a plausible answer.
Deletion is a tombstone plus exclusion from retrieval, made permanent by compaction. forget on the head of a version chain takes a mode: by default (revert) it removes the head and makes the previous version current again; object removes only that version and chain removes the whole correction history. Nothing is restored except as the chosen mode says. On connector content, forget tombstones the whole source, resolving a child target to its root first. Deletion integrity, that forgotten content stays out of every later recall including after compaction and a restart, is a hard-fail line in the published evaluation, not a scored metric.
No application-level encryption at rest, in the free local tier. Mitigation is full-disk encryption (FileVault, BitLocker, LUKS). Stated here rather than omitted. We do not plan application-level vault encryption: the key would have to sit on the same computer, so it would add nothing to disk encryption.
The on-disk format is proprietary, which is not a security property. A shipped binary can be reverse-engineered.
Cloud-sync guard. The daemon compares its data directory against known sync-folder patterns at startup and refuses to start on a match, because disk encryption does not prevent a sync client from uploading the decrypted view.
In transit: local traffic never leaves the socket. Sync, managed backup and Teams data are encrypted on your computer before upload, with keys held by your computers, and travel over TLS. The ChatGPT relay reads each message to route it but does not store its content.
Sync and backup. Your computers encrypt everything before it is uploaded, with a vault key that only your computers and your 24-word recovery phrase hold. Our servers store and check the encrypted data but cannot decrypt it. They hold an account, an email address, device names, billing records, and the size and timing of uploads. If you lose every approved computer and the phrase, neither you nor we can recover the synced data.
Local-only partitions. A partition you mark local-only is not synced, and its content is never uploaded.
Teams. Shared partitions are end-to-end encrypted with their own keys, held only by members' computers. Our servers see partition names, sizes and who has access, never memories. Removing someone changes the key on the next sync, and an owner or admin confirms each removal in the app.
ChatGPT relay. ChatGPT can only reach outside tools over the internet, so its requests pass through a relay we run. The relay reads each message to route it but does not store the content; it logs the method name and the size. OpenAI receives whatever ChatGPT recalls, under OpenAI's terms. A connection needs a signed-in ModelBrain account, and we email you each time ChatGPT is connected to a computer.