How your memories are protected

• Every memory's content, title, summary, and topic tags are encrypted at rest with AES-256-GCM.
• Each user has their own encryption key; that key is itself wrapped by a master key that lives in the server's secret store — never in the database. A database leak alone does not expose what your memories say.
• All traffic runs over HTTPS with HSTS.

What is not encrypted: the search vectors derived from your memories, which are what make search work. They store no text, but they do describe its subject matter — treat them as metadata a database leak would reveal. Your topic tags are encrypted; the graph matches them through per-account keyed digests, which show that two of your memories share a tag without revealing which tag, and never match across accounts.

The honest limit: everything above is server-managed encryption. Our systems decrypt your content to do their job — extracting memories, building search, writing your digest — so our operators could technically access it, and we design processes so they don't. If that is not a good enough guarantee for something, it belongs in the Vault below, where it is not a guarantee we are asked to keep: we simply cannot read it.

A Vault item — a password, a private note, a document — is encrypted in your browser with a key derived from a passphrase only you know. The server stores bytes it has no way to open.

• Your passphrase never leaves your device, and neither does the key it unlocks. We cannot read your Vault, reset your passphrase, or recover your items — not for a support ticket, and not for a court order. We can produce only ciphertext.
• Argon2id turns your passphrase into a key deliberately slowly, so guessing it is expensive. AES-256-GCM protects each item, bound to its place in your vault so nothing can be moved, swapped, or truncated undetected.
• Nothing in your Vault is processed by AI. No extraction, no embeddings, no synthesis, no weekly digest, no graph edges. It is not reachable by the browser extension or by MCP. That is the price of us being unable to read it, and it is not a setting we can flip.
• Search over your Vault runs entirely in your browser, over names decrypted on your own device. We never see your item names, or what you searched for.

If you forget your passphrase and lose your recovery code, your Vault is gone. Permanently, for everyone, including us. That is not a policy we could choose to relax — it is what “we cannot read it” means. Your recovery code is shown exactly once, when you create your Vault.

Encryption protects data in our hands. It cannot protect data in someone else's.

• A compromised device. Malware, a keylogger, or someone with your unlocked laptop sees your passphrase as you type it. Nothing cryptographic helps with that.
• Phishing. If you type your passphrase into a convincing fake, it is theirs.
• Malicious code served by us. This is the real limit of any browser-based encryption, and we would rather name it than hide it: the JavaScript that handles your passphrase is delivered by us on every page load, so a compromised or legally compelled build could capture keys. Our strict Content Security Policy blocks injected scripts and blocks sending your data anywhere but here, which is the strongest defence available to a web app — but a browser extension or desktop app, whose code is versioned and updates visibly, would be genuinely stronger. That is on our roadmap. Until then, do not treat the web Vault as protection against Mind Silo itself being compromised.
• Someone who already has your passphrase. There is no second factor on the Vault itself. A strong, unique passphrase is the whole defence, which is why we insist on one.

Encryption hides contents, not the shape of them. Even for Vault items, our servers can observe:

• That you have a Vault, and when you created it.
• How many items are in it, and whether each is a password, a note, or a document.
• Roughly how large each item is. We round sizes into coarse buckets on purpose, so a twelve-character password and a forty-character one are indistinguishable — but a short note and a large PDF are not.
• When items were created, changed, and opened. The timing of access is visible even though the contents are not.

Item names, passwords, note text, filenames and document contents are not in that list. They are encrypted before they reach us.

• Every query is scoped to your user id on the server — no request can read another user's data, including similarity search, which never compares across accounts.
• Extension and MCP access uses scoped tokens you create and revoke — they expire after 90 days by default, are stored only as hashes, and compared in constant time.
• Full export requires your sign-in session — a leaked extension token can't pull your entire archive.
• Every access to your memories is written to an audit log you can review (~90 days).

• Sell your data or use it for advertising.
• Train models on your memories.
• Cache your content in plaintext — API responses carry no-store headers, and even our internal report caches are encrypted with your key.

We do send content to Anthropic (extraction, synthesis) and OpenAI (search embeddings) to run the product — details in the privacy policy.

• Export everything, self-serve, from Settings → Security — every memory, decrypted, in one JSON file.
• Delete means delete: trashed memories are recoverable for 30 days, then permanently erased; you can empty the trash instantly.
• Revoke any connected tool's access in one click.
• Pause capture anytime from the extension.

Please report it to security@mind-silo.com — we read every report and will credit you if you'd like. Please don't test against other users' data.