Security Policy
Responsible disclosure
Section titled “Responsible disclosure”If you find a security vulnerability in MemStrata software or infrastructure, email security@memstrata.dev.
- We aim to acknowledge all reports within 24 hours.
- We target a patch or mitigation within 7 days for critical issues.
- We will not take legal action against researchers who follow this policy.
Request the current PGP public key from security@memstrata.dev.
What runs locally
Section titled “What runs locally”By default, imported sources, indexes, and local answering-model inference stay on the device. Provider keys are stored in the operating-system credential vault.
Loopback product services bind to localhost. Do not assume a single suite-wide port.
Network communications
Section titled “Network communications”MemStrata is local-first, not air-gapped. Outbound calls depend on what you enable:
| Flow | Typical destination | Data |
|---|---|---|
| Account, OAuth, entitlements, device registration | MemStrata hosted services | Identity and device-bound entitlement fields |
| Licensing | MemStrata hosted licensing | Entitlement check |
| User-selected cloud answering model | The provider you configure | Question and selected evidence for that request |
| Optional connectors or managed email | The destination you configure | Minimized message and recipient |
| Website | Plausible, Vercel, Cloudflare | Page and request metadata as disclosed |
No source tree is uploaded for training. Customer content is not used for training unless the customer separately opts in.
Known limitations
Section titled “Known limitations”- Optional browser capture, if installed for a product that supports it, needs host permissions for the consented sites.
- Local services may use localhost TLS exceptions expected for loopback development.
SOC 2 Type II is not claimed. For a procurement questionnaire, email security@memstrata.dev.
Bug bounty
Section titled “Bug bounty”We do not currently run a formal bug bounty. Researchers who disclose valid issues may be credited in release notes if they wish.