Trust Center

How XMemo keeps your memory private, secure and under your control.

Every request is checked against who is making it: apps, agents, sessions and API keys reach only the memory their sign-in or key allows.
Unsafe production settings, such as weak session secrets, missing token protection or plain-text keys, fail the readiness check and stop the release.
Every release runs the full test suite and a production-readiness check before it ships.

Security controls

Public pages, account management and your memory sit behind separate access layers. Managing the service needs an admin key or a signed-in session; reading or writing memory needs a credential scoped to that memory.

Single sign-on settings never reveal client secrets.
Tokens and API keys are stored only as protected hashes, never in plain text; plain-text API keys are disabled in production.
MCP connections use tokens issued per connection, and you can revoke them at any time.
Every public page is served with strict browser security headers, including HSTS and a nonce-based Content Security Policy.

Privacy and data requests

Your account settings show what data XMemo holds for you and whether export and deletion are available. Export and deletion requests are completed and recorded without copying your memory content anywhere public.

Exports never include secrets such as key hashes, session secrets or database addresses.
Deleting or redacting a memory keeps an audit record of the action, not of the content.
Automatic redaction records only how much was redacted, never what.

Where your memory lives and how to control it

Your memories belong to your XMemo cloud account, workspace or team. Keyguard and Vault protect service credentials and tokens, and agents reach your memory only through an OAuth sign-in you approved or a key you created.

Where is my data? In the hosted service, memory is stored in Microsoft Azure, Japan East. See Subprocessors for every provider involved.
Who can access it? You, people you share a workspace with, and agents whose sign-in or key allows that specific action.
How do I delete or export it? In the Memory Console. If an option isn't available to you, contact support and we will handle it for your account only.

Reliability and releases

We keep written procedures for key rotation, backup and restore, rolling back changes, incident response and data requests. Every tagged release runs the unit, enterprise and web test suites and a production-readiness check before deployment.

The production-readiness check is executed on every release, and a release is blocked if it fails.
Supply-chain records (SBOM, signatures and SLSA provenance) come from a pipeline that is run on demand rather than for every release; contact support to request them for a specific version.

Based on XMemo's security and privacy documentation and its release process. For more detail, contact support@xmemo.dev.