Security Policy
Responsible disclosure
Section titled “Responsible disclosure”If you find a security vulnerability in MemStrata software or infrastructure, please email security@memstrata.dev.
- We aim to acknowledge all reports within 24 hours.
- We target a patch or mitigation within 7 days for critical issues.
- We will not take legal action against researchers who follow this policy.
Request the current PGP public key from security@memstrata.dev.
Architecture security guarantees
Section titled “Architecture security guarantees”What runs locally
Section titled “What runs locally”The following never leaves your machine by design — it’s an architectural constraint, not a policy:
- All source code and codebase graph data (
~/memstrata/index.db) - All AI prompts you send and responses you receive
- All session telemetry and savings metrics (
~/memstrata/telemetry.db) - Your LLM provider API keys (stored in OS keychain)
The local harness listens on localhost:8080 only — it is not bound to external network interfaces.
Network communications
Section titled “Network communications”The only outbound network call MemStrata makes is to memstrata.dev/lic for license verification. This call transmits:
| Data | Format |
|---|---|
| Subscription ID | Opaque UUID, not email |
| Hardware ID hash | HMAC-SHA256, salted per-license |
| JWT expiry | Timestamp only |
| MemStrata version | Semver string |
No source code, prompts, file paths, or API keys are transmitted.
License server
Section titled “License server”- Deployed on Cloudflare Workers — no persistent storage of code or prompts
- Hardware ID hashes are stored salted and cannot be reversed to raw hardware identifiers
- License verification logs retained 90 days, then purged
- All communication over TLS 1.3 with HSTS
Known limitations
Section titled “Known limitations”- The browser extension requires
host_permissionsfor supported AI provider domains. These permissions are used only for the consented local integration described in the product privacy notice. - The harness proxy does not validate TLS certificates for
localhostconnections (expected behavior for local services).
SOC 2 Type II is planned for V7 (post-Series A). If you need a security questionnaire completed for a procurement process, email security@memstrata.dev and we’ll provide our architecture documentation and respond to specific controls.
Bug bounty
Section titled “Bug bounty”We do not currently run a formal bug bounty program. Researchers who responsibly disclose valid vulnerabilities will be publicly credited (if they wish) in the release notes.