Prompt injection
Untrusted content is data, never instructions.
Content is marked by where it came from, and high-consequence tools stay behind approval, so an injection that gets through still cannot ship code or move money.
Trust & securityThis is a tool that inspects credentials.
This is a tool that inspects credentials.
So it is built to be inspected back.
A secret Memnox reads never leaves the process that read it: it keeps a path, a kind and a hash. The first run sends nothing, and no model decides what is allowed.
- Encrypted in transit and at rest
- TLS 1.2+ in transit, AES-256-GCM at rest under a rotatable key.
- Approval before consequence
- An ask goes to the person who owns it, and a timeout never approves.
- Fingerprinted, never stored
- Secret values, tool arguments and results are hashed or summarised, and never trained on.
- Scoped per workspace
- Every read is scoped to one workspace, with no cross-tenant path.
ComplianceWhere we actually stand.
Where we actually stand.
Including where we don't yet.
The status each framework has today, taken from our control register.
StandardStatusCoverageDocumentation
GDPR
Partially implemented
Access, export, retention and erasure (Art. 15, 17, 30, 5) are implemented; audit evidence is kept so the chain still verifies.
DPA and breach runbook in drafting, so Art. 28 and 33 are not yet met.
CCPA
Partially implemented
The same access and deletion controls. Memnox does not sell or share personal information.
Privacy notice ships with the GDPR drafting.
SOC 2 Type 1
In progress
Access, change and monitoring controls are partial. The largest gap is a tested backup restore.
Control status shared under NDA.
ISO 27001
In progress
Cryptography is implemented, logging is partial, and there is no ISMS yet.
Controls overview on request.
Data handlingExactly what we touch.
Exactly what we touch.
And exactly what we never will.
The list on the right is what makes the list on the left safe to grant.
What Memnox does
Encrypts what it stores- AES-256-GCM per record, with keys kept apart from the data.
- Signs in through your IdP
- OIDC with Okta, Entra ID or Google Workspace. Roles come from Memnox, never from a claim.
- Sends nothing on the first run
- Discovery and hardening need no account and no network.
- Prints the undo first
- Every change states its inverse, and one command puts it back.
- Proves what happened
- A hash-chained log of every decision and the policy version behind it.
- Deletes completely
- Retention is swept daily, and deleting an account returns a receipt.
What Memnox never does
- Store a secret it read
- It keeps a path, a kind and a hash, never the value.
- Keep what an agent read
- Tool arguments are hashed and results summarised.
- Let a model decide
- Rules decide. Untrusted content is data, never instructions.
- Train on your data
- Not ours, and not our model providers'.
- Put a credential in model context
- Connections use OAuth with narrow scopes, and keys are stored encrypted.
- Reach across workspaces
- There is no cross-tenant read, including for us.
Autonomous workWork that runs on its own
Work that runs on its own
opens surfaces ordinary software never had.
Three of them, and none is solved by a firewall.
The context seam
Agents can ask it questions. It cannot change anything.
The MCP and API seam holds no tool that writes, carries its own revocable grant, and says when an answer was filtered.
Model providers
Named providers, no-training terms.
Each is listed as a sub-processor and contractually barred from training on Memnox traffic.
Responsible disclosure
Found something? Tell us.
Send what you found and how, and a person will reply.
support@memnox.com- A real acknowledgement
- A person reads your report and replies with what happens next.
- Public credit, if you want it
- Named on the advisory, or kept anonymous, your call.