# Who can see what. How you take it with you.

Security and ownership. This page separates three things that are usually blurred together: behaviour working in the current deployment, work in progress with a defined gate, and claims we deliberately do not make yet.

- Default deny
- No agent writes canonical memory
- Readable Markdown, always

Canonical: https://unforgetter.com/security

## Rules that do not depend on a prompt.

These hold in code and configuration, not in instructions to a model. A control counts as implemented only when it has been tested against a concrete attempt to break it.

- **Default deny**: An agent sees only explicitly allowed workspaces, projects, data classes and operations.
- **The whole vault is never sent**: Context is bounded. Deeper retrieval is scoped and on demand.
- **Every record is bound**: Workspace, project, actor, trust zone, provenance and data class travel with every record and operation.
- **Agents read, search and propose**: Only the workspace consolidator publishes canonical memory.
- **Protected targets**: Goals, policies, permissions and identities cannot be changed by an agent.
- **Taint is monotonic**: Untrusted content can raise scrutiny and never lower it. A tainted session cannot perform actions that need approval.
- **Secrets stay apart**: Connector secrets are separated from memory and from model context.
- **Audit without leakage**: Logs keep metadata, digests and results, not raw secrets or unnecessary memory content.

## Scopes, provenance and the write path.

- **Identity · Workspace, actor, trust zone and role come from the token** (Working now): Each agent zone holds its own revocable bearer token. Projects are selected from the token's catalogue and selection cannot widen authority.
- **Scope · Server-enforced project and data-class scopes** (Working now): A restricted fixture has been hidden from the catalogue and refused on direct retrieval, search, cursor replay and proposal target. Continuous cross-tenant coverage is an alpha gate.
- **Provenance · Every context response carries source and compile time** (Working now): You can trace a served fact to the document, the date and the person or agent who put it there.
- **Write path · Append-only proposals, quarantine, single publisher** (Working now): Proposals are attested, de-duplicated by request id and delivered exactly once. Tainted proposals go to a marked quarantine for stricter review.
- **Format · Canonical memory is versioned Markdown** (Verified): It opens in any editor and needs no Unforgetter software to read.

## What belongs in the memory during the alpha.

You decide what is connected. Nothing reaches the memory unless you configure it as a source, and this is where the boundary for an early product is stated in full.

- **In scope · Project, product and client working material**: Status, decisions and their reasons, preferences and methods, open threads and the documents they trace back to. Client material can be kept in its own scope so other scopes cannot list or retrieve it.
- **Not yet · Special-category personal data**: Health, biometric and similar categories are outside the alpha while the DPA, the subprocessor list and an independent penetration test are still outstanding.
- **Never · Production credentials and secrets**: Keys, tokens and passwords belong in a secret manager. Connector secrets are kept apart from memory and from model context.

If the material you need to keep sits outside this, say so in the application. The requirement is more useful now than at onboarding.

## Where things run today, stated as facts.

The current service is a single-workspace deployment. Hosting changes for external alpha workspaces will be published here before they take effect.

| Component | Today | Status |
| --- | --- | --- |
| Gateway (context, search, proposals, MCP) | Hosted on Railway in an EU West region with persistent storage | Working now |
| Canonical writer and consolidation | Runs on a controlled machine under the workspace owner; publishes to the gateway every 15 minutes and after each consolidation | Working now |
| Canonical memory format | Versioned Markdown plus an append-only proposal journal | Verified |
| This website | Static site on Vercel; no product data, no accounts, no memory | Verified |
| Model providers | Claude, ChatGPT / Codex, Cursor and Grok Bot receive scoped, bounded context through MCP. No workspace dump. Provider retention and training policies are recorded per data class | Compatible |

> In build. Managed object storage, envelope encryption per workspace, versioned backups with automated restore tests and a published subprocessor list are part of the alpha foundation. They are not live in the current deployment.

## Leaving must be as easy as joining.

Export, revoke and delete are product functions in the alpha foundation, each with a live smoke test as its gate.

- **Export** (In build): A workspace export is readable Markdown plus a provenance manifest. It must open without Unforgetter.
- **Revoke** (In build): Revoking an agent's connection stops it being served immediately. Current tokens are revocable and time-limited; the self-service flow is in build.
- **Delete** (In build): A deleted workspace disappears from every serving path, including indexes and, after the documented retention window, backups.
- **Version history** (Working now): Changes are versioned with actor and evidence. You can see what moved, when and why.

Example export layout: workspace/booking-product/working-state.md (compiled record with state, decision, provenance lines), workspace/booking-product/history/ (superseded and rejected entries with dates), workspace/journal.jsonl (append-only proposal and publish events), workspace/manifest.json (scopes, actors, compile times).

## Models are treated as untrusted decision-makers, not as access control.

- Model output is validated against schemas and policy before anything downstream uses it.
- External content is marked untrusted at ingress; taint follows chunks, context and proposals.
- Read and act are separated in the gateway. Tainted sessions can read, analyse and propose, nothing more.
- An injection canary is planted in test task material. If it appears in a proposal or a tool action it is counted as an event, and the target is zero.
- Approval is a server-side object that is short-lived and operation-specific. A model saying the owner agreed is not an approval.

## What you will not find on this page.

- **SOC 2, ISO 27001 or similar** (Not claimed): No certification exists and none is implied. Change logs, access reviews and incident processes are collected from day one so an audit is possible later.
- **Independent penetration test** (Planned): Planned before any workspace with sensitive data and before a paid public beta. Not yet performed.
- **Multi-tenant isolation** (In build): Specified with adversarial cross-tenant tests as its gate. Not claimed until the gate passes.
- **DPA and subprocessor list** (In build): Drafted as part of the alpha readiness review. Published before external workspaces are admitted.

If you need a specific control before you can consider the alpha, say so in your application. It is more useful to hear the requirement now than to discover it at onboarding.

## Ask the hard question in the application.

Applications are read by the person building the system. Security requirements and blockers are welcome.

- [Join the private alpha](https://unforgetter.com/private-alpha)

## Next

- [How it works](https://unforgetter.com/how-it-works)
- [Company Brain](https://unforgetter.com/company-brain)
- [Documentation](https://unforgetter.com/docs)

---
Status: Private alpha · guided setup. Contact: hello@unforgetter.com.