Goals, ownership, approval chains, policies, customer context, and the decisions behind all of it live in one place. That only works if credentials never reach a model, consequential actions wait for the person who owns them, and nothing you connect is ever used to train anything.
Every framework below carries the status it has today, not the one we are working towards. This table is generated from our control register, the same one our engineers work against, so it cannot drift from the code. Send it to your security reviewer; it is written for them.
Records of processing (Art. 30), subject access and export (Art. 15), and retention limits enforced by a daily batched sweep (Art. 5(1)(e)) are implemented. Erasure (Art. 17) cascades through every workspace an organization owns and returns a receipt, with one deliberate exception: hash-chained audit evidence is retained, because erasing it would break the chain that proves everything else. Security of processing (Art. 32) is partial while TLS termination sits outside the application.
DPA, privacy notice, and breach runbook are in legal drafting, Art. 28 and Art. 33 are not yet met. Control status and evidence paths available under NDA today.
The same access, deletion, and portability controls satisfy California consumer rights. Memnox does not sell or share personal information.
Privacy notice and the Do Not Sell or Share disclosure ship with the GDPR drafting work.
Independent attestation that our controls operate as designed. Access control, change management, and monitoring are partially implemented. Still to build: structured logging with correlation IDs, a signed SBOM attached to each release, enforced branch protection with per-release evidence, and, the largest gap, backups with a tested restore. We have no restore drill today, and an untested backup is not a control.
Current control status shared under NDA. Attestation follows the audit; Type II adds an observation window on top of it.
Cryptographic controls are implemented. Logging and monitoring are partial. There is no ISMS, risk register, or Statement of Applicability yet, and no continuity plan.
Controls overview available today. Certification requires Stage 1 and Stage 2 audits by an accredited body.
Certification is bought as much as it is built. Every technical control an assessor samples can be finished on our schedule; the attestation itself waits on an external firm and, for Type II, an observation window. This page will say so until the report exists.
Memnox reads across the systems your organization already runs on. The list on the right is the one that makes the list on the left safe to grant.
Encrypts what it stores
Train on your dataArchitecture reviews, data-processing detail, and our current control status are covered directly with your security and legal teams.
Three of them are specific to how this works, and none are solved by a firewall.
Prompt injection
A support ticket, a pull request comment, or a shared document can carry an instruction aimed at your agents. Memnox classifies content by where it came from, marks anything from an untrusted source in the extraction prompt itself, and keeps every high-consequence tool behind human approval, so an injection that gets through still cannot move money, ship code, or email a customer.
The context seam
What an agent reaches Memnox through, over MCP or the API, is a read seam: it holds no tool that writes, so no request through it can alter a policy, an approval, a decision or a fact. It carries a grant of its own rather than the credential the agent acts with, so what an agent may know is issued and revoked separately from what it may do. Anything classified restricted is refused to a machine whatever its grant says, and every answer reports how much was withheld, so a filtered answer is never mistaken for a complete one.
Model providers
Inference runs on named model providers, each listed publicly as a sub-processor and each contractually barred from training on Memnox traffic. You know which company processed which request.
Persistent memory
The understanding Memnox builds of your organization is scoped to your workspace, encrypted at rest, exportable in full, and erasable on request, with the deletion cascading through every workspace under the organization and returning a receipt.
Reading a document means running a PDF or Office parser over bytes a stranger chose, the kind of code that is exploited for a living. So it does not run where anything else does.
Every workspace is scoped twice. Workspace id is a required argument on every stored read, there is no unscoped query to issue, and each request resolves which workspaces the caller's organization reaches before anything runs. A workspace outside that scope returns 404, not a filtered result.
GitHub, Slack, Notion, Google Drive, Microsoft 365, Salesforce, HubSpot, Jira, Linear, Stripe, Gmail, Calendar, your internal APIs, and the AI agents you already run. Each connects on the narrowest terms that let it do its job.
Connections are stored encrypted and used only by Memnox's own connectors. The model composes the request and reads the result; the key is never part of either.
Every major system connects through OAuth with the narrowest scopes that do the job. No passwords are stored, and consent stays visible in the tool that granted it.
Where an API key is the only option, it is encrypted at rest under the platform keyring, kept out of model context, and rotatable without redoing the integration.
Which systems connect, who may use them, and at what level is an administrator's decision, and any integration can be revoked in one click without touching the rest.
We would rather hear about an issue from you than read about it somewhere else. Send us what you found and how you found it, and you will get a human reply, not an autoresponder.
support@memnox.com