MemNexus Trust Center — Compliance Overview

Document ID: COMP-006 Last updated: 2026-04-28 Status: Current Contact: [email protected]

1. Overview

MemNexus is an AI memory management platform for developer teams. It stores knowledge, decisions, behavioral patterns, and institutional memory on behalf of its users, with field-level encryption and per-user key isolation.

This page indexes all security, compliance, and data handling documentation for MemNexus. It is intended as the primary reference for enterprise procurement teams, compliance officers, and security reviewers conducting vendor due diligence.

We state only what is implemented and deployed today. Where capabilities are planned but not yet complete, they are explicitly marked as such.

2. Data Handling Summary

2.1 What Data MemNexus Stores

Note on embedding vectors: Embedding vectors (used for semantic search) are stored unencrypted. This is a documented engineering decision — encrypting embeddings would prevent vector similarity search. Embedding vectors are mathematical representations, not human-readable content, but they are derived from user content. Encryption of embedding vectors is planned for a future phase. All other sensitive fields (13 of 14 field types) are encrypted at the application level.

Note on AI provider processing: Memory content is decrypted server-side and sent over TLS 1.3 to AI providers (Voyage AI, OpenAI, Anthropic) for embedding and extraction. Providers do not store this content per their published policies (linked in Section 3).

2.2 Where Data Is Stored

• Primary database: Neo4j, self-hosted on Azure Kubernetes Service (AKS), US East 2 region
• Encryption key management: Azure Key Vault, US East 2 region
• No multi-region replication: All data is processed and stored in a single Azure region (US East 2)

3. AI Training Posture

MemNexus does NOT use customer data to train AI models.

• Customer memories and extracted knowledge are NOT used for model training, fine-tuning, or improvement of any kind.
• Customer data is processed solely to provide the MemNexus service to the customer.

Third-Party AI Providers

MemNexus uses third-party AI APIs for embedding generation and knowledge extraction. Neither provider uses API data for model training:

MemNexus does not opt in to any provider training programs. Data sent to these providers is used exclusively for real-time processing and is not retained by the providers for training purposes.

4. Data Flow Lifecycle

4.1 Saving a Memory

Developer saves a memory via CLI or MCP tool
  |
  v
1. API Gateway (Kong) -- TLS termination, authentication
  |
  v
2. Core API -- Input validation (Zod schema)
  |
  v
3. Encryption -- Content encrypted with user's encryption key
  |
  v
4. Storage -- Encrypted content stored in Neo4j
  |
  v
5. Async: Extraction Pipeline
   |-- Embedding generation (OpenAI API, TLS 1.3)
   |-- Entity/fact/topic extraction (Claude API, TLS)
   +-- Results encrypted and stored
  |
  v
6. Audit -- Memory creation event logged (metadata only, no content)

4.2 Retrieving Memories

Developer searches memories via CLI or MCP tool
  |
  v
1. API Gateway -- Authentication, rate limiting
  |
  v
2. Core API -- Query validation, user/org scoping
  |
  v
3. Search -- Vector similarity + keyword search (encrypted content decrypted for authorized user)
  |
  v
4. Response -- Decrypted results returned over TLS

4.3 Key Points

• Content is encrypted before it reaches the database. The database stores ciphertext for sensitive fields.
• Decryption occurs only for the authenticated user who owns the data, using their unique encryption key.
• Audit entries capture metadata about operations (action type, timestamp, actor) but never capture memory content or search queries.

5. Compliance Status Dashboard

5.1 Security and Data Documentation

5.2 Legal Documentation

5.3 Operational Documentation

5.4 Integration Guides

6. Certification Roadmap

MemNexus is committed to achieving SOC 2 Type I as the next milestone in the certification roadmap. Controls are documented across the security, operational, and legal documentation listed above. Auditor engagement timing will be communicated when confirmed. SOC 2 Type II will be pursued after Type I completion; we do not commit to a public timeline.

7. Frequently Asked Questions

Do you train on my data?

No. MemNexus does not use customer data to train, fine-tune, or improve any AI models. Third-party AI providers (OpenAI, Anthropic) process data via their APIs under policies that explicitly exclude API data from model training. See Section 3: AI Training Posture.

Where is my data stored?

All customer data is stored in Microsoft Azure, US East 2 region. The database (Neo4j) runs on Azure Kubernetes Service (AKS) within that region. Encryption keys are managed via Azure Key Vault in the same region. There is no multi-region data replication.

Can I delete all my data?

Yes. Account deletion is self-service via the customer portal or API. After a 7-day grace period (during which deletion can be cancelled), all data is permanently and irreversibly deleted from all systems, including third-party processors (WorkOS, Stripe). This is GDPR Article 17 compliant. See Data Retention and Deletion Policy.

Do you have SOC 2?

Not yet. Security controls are documented and operational. SOC 2 Type I auditor engagement is planned but not yet started. See Section 6: Certification Roadmap.

Who are your subprocessors?

Our complete subprocessor list is published at memnexus.ai/trust/subprocessors and updated whenever we engage a new vendor. We publish subprocessor changes to this page and notify customers via email prior to adding new subprocessors. Subscribe by emailing [email protected]. Full details, including data categories processed and processing locations, are in the Subprocessor List.

Do you support SSO?

Yes. MemNexus supports SAML 2.0 and OIDC for Single Sign-On via WorkOS, configurable per organization. See the SSO Integration Guide.

Is my data encrypted?

Yes. 13 of 14 sensitive field types are encrypted at the application level with AES-256-GCM-SIV before storage. Each user has a unique encryption key. Data in transit is protected with TLS 1.2+. See Security Practices.

Can I export my data?

Yes. Self-service data export is available via the customer portal and API (GET /api/users/me/export) in JSON format. Export remains available during the deletion grace period. This satisfies GDPR Article 20 (Right to Data Portability).

Do you have a DPA?

A GDPR Article 28-compliant Data Processing Agreement is available on request. Contact [email protected] to request a copy.

8. Contact

9. Document History