/ SecuritySecurity & Architecture
We treat your memory as infrastructure. Here is exactly how the system is built, what we can see, and what we cannot.
Current Architecture
Encryption
In Transit
All traffic between clients and the API, and between the API and the database, is protected by TLS 1.3.
At Rest
Application-layer AES-256-GCM. Every stored memory is encrypted with a unique key derived via scrypt (N=16384, memory-hard) from a server master key + a fresh per-ciphertext 32-byte salt.
Layout: [salt 32][IV 12][auth tag 16][ciphertext]. The master key lives only in the server environment. Self-hosting gives you full control of it.
Access & Privacy
- Only you can read or write your memories through authenticated MCP or REST calls using your API keys.
- Unimatrix operators can access ciphertext at rest and, using the master encryption key, plaintext — but only in support or security investigations. All such access is logged in the per-account audit trail.
- We never train on your data. We never sell it. Obvious secrets and PII are redacted before any embedding or classification step.
- Raw API keys are never stored — only bcrypt-hashed prefixes for lookup.
Retention & Deletion
Memories, locations, palaces, and their vector embeddings are retained until you delete them (via dashboard, API, or full account deletion).
On deletion we purge the primary rows and vector index entries. Backups follow the retention window of the underlying database provider and are then removed.
Audit logs are kept for a limited security and incident-response window, then deleted. You can always export your complete hierarchy first.
Full export + delete is available to every account at any time.
Self-Hosting
The entire stack (API, Postgres schema, encryption, MCP server, audit) is open and runnable with Docker + your own PostgreSQL 15+ instance with pgvector.
You supply the MASTER_ENCRYPTION_KEY, Clerk (or equivalent), and Voyage AI key. This gives you complete control over the master key and data location.
Reporting a vulnerability
Please report security issues privately via GitHub Security Advisories or to security@unimatrix.app. We aim to acknowledge reports within 48 hours.