Public security overview · reviewed July 29, 2026
Personal memory deserves visible boundaries.
Security at hippocampOS starts with a product promise: you choose what enters a brain, the system keeps recall inside the scope you selected, and deletion removes the machinery behind that memory—not merely its screen.
01
You choose every source
Nothing is connected silently. You authorize each connector, select its brain, and decide when a source should sync.
02
Recall stays in scope
A normal search is constrained to your account and selected brain. Cross-brain recall happens only when you choose Master Brain.
03
Credentials are protected
Connector credentials stay on the backend, protected from browser access, and OAuth handoffs are bound to the signed-in user.
04
Removal follows provenance
Brain deletion clears its full scope; an audited connector rebuild removes only that connector’s contribution and preserves evidence still supported elsewhere.
Protection should be something you can use.
The most important security decisions appear as normal product choices: which provider to connect, which brain receives it, whether a sync runs, which brain is invoked, and when data should be removed.
A source opens only after you say yes.
- Gmail access is read-only; hippocampOS cannot send, edit, or delete your email.
- Google Photos uses the Picker permission, so only media you explicitly select is imported.
- Freeform, ChatGPT Memory, and Claude Memory process only the text or files you submit.
- Connector authorization is tied to the active account and selected brain; callback state is signed and verified.
The server decides who you are.
- Private pages require an authenticated Clerk session.
- The backend validates session tokens and restricts accepted application origins.
- Tenant and user identity are derived on the server, not accepted from browser-supplied form fields.
- Administrative routes perform a separate privilege check rather than relying on a hidden link.
Brains are retrieval boundaries.
- Memory, facts, beliefs, graph traversal, and source fetches are filtered by tenant and owner.
- Brain-scoped requests add the graph identifier before candidates are ranked or assembled into context.
- A Master Brain query is an explicit aggregate mode, not a silent global search.
- Ownership checks also apply when an AI client fetches a specific MCP result by ID.
Secrets are not ordinary profile fields.
- Notion tokens and connector API keys are encrypted with AES-256-GCM before storage, including integrity authentication.
- MCP client secrets, authorization codes, access tokens, and refresh tokens are stored as hashes rather than reusable plaintext.
- OAuth redirect URIs and return URLs are validated to prevent an authorization result being sent to an unapproved destination.
- Application secrets remain on the backend; the frontend has no database, queue, or secret-store access.
The boundary travels with the data.
Source identity and brain ownership are carried from collection into processing, recall, and deletion. Independent evidence identities also prevent a retry from being counted as a new source. These are not labels added after the system has already mixed everything together.
Step 1
Connect
You see the provider, requested capability, and destination brain before authorization begins.
Step 2
Collect
The service fetches only what the connector permission permits and records source identity for provenance and cleanup.
Step 3
Process
Jobs carry tenant, user, brain, and connector context. Inputs are validated and user-facing rich text is sanitized.
Step 4
Recall
Search and MCP tools apply ownership and brain scope before private context can be returned.
Step 5
Delete
Brain deletion clears associated records and queued work; an admin connector rebuild removes only the selected source contribution before fetching or reprocessing it again.
MCP is a narrow door, not a master key.
Connecting an AI client gives it a deliberately small memory surface. It does not expose the admin console, billing, connector credentials, worker controls, or arbitrary database access.
Two scopes
MCP exposes only brains:read and search:read.
Four tools
Clients can list brains, search, fetch a result, and invoke a brain—nothing administrative.
OAuth bound
Authorization is linked to the signed-in tenant and user, with PKCE support and expiring credentials.
Auditable
Authorization and invocation activity is recorded with client, owner, scope, and outcome context.
Quiet controls behind every screen.
Public traffic uses HTTPS. The production database is not publicly reachable, and the browser communicates with data services through authenticated backend routes rather than direct database or queue connections.
Content Security Policy, clickjacking protection, MIME sniffing protection, a restrictive referrer policy, and browser permissions policy reduce common web attack paths.
Allowed frontend origins are restricted at the API boundary. Private responses use private or no-store cache rules where sensitive state must not be shared.
Request identifiers, MCP audit records, job outcomes, and health checks make failures and suspicious access diagnosable without exposing secret values in the interface.
AI receives context for a job, not ownership of your life.
- Selected content may be sent to configured AI providers only to deliver hippocampOS features such as extraction, summarization, and search.
- Google user data is not used for advertising, resale, surveillance, credit decisions, or training generalized AI models.
- Provider and model selection is visible in product settings where configuration is available.
- Derived facts preserve source provenance so important answers can be checked against the underlying record.
Trust also means saying what we do not claim.
This is an implementation overview, not a certification badge. We will update it as the product, infrastructure, and independent assurance program evolve.
- We do not claim that any internet service can provide perfect security.
- We do not claim end-to-end encryption: hippocampOS must process authorized content to build and retrieve memories.
- We are not currently presenting SOC 2, ISO 27001, or an independent penetration-test certification on this page.
- AI-generated summaries and facts can be wrong. Important decisions should return to the linked source evidence.
Security should be discussable.
Report a security concern or ask how a specific feature handles your data. Please do not include passwords, access tokens, or sensitive source content in the first message.