Our guidelines. What we do with your data, and what our agents are allowed to do.

Is my data safe? The short version.

Separation and encryption are enforced by the system, not left to a rule someone has to remember.

Kept apart in the database: Every table carries row-level security for its company, and a test fails if a table is left out. Teams data lives on its own database, separate from our personal product.
A key for each company: Secrets and files are sealed with AES-256-GCM under a data key belonging to that company, and bound to it, so a value copied elsewhere will not open.
Your model keys: A key is saved only after a test call works. Only an admin can save one, no response ever returns it, and it is never logged or given to code running a job.
You decide how long: Your data stays until you delete it.
We don't sell your data: Your model provider handles what it receives under your own agreement with them.

An agent is a specialist with limits set outside the model, so it cannot talk its way past them.

You control what agents can access: Agents reach only the tools your company connects.
Sealed code: Code an agent writes runs in its own sandbox for that one task, with the internet off by default, and the sandbox always closes.
Bound to one company: Every step of a task is pinned to the company that asked. Each task has a time limit that really stops it, and each company has a daily spending limit.
Files are not instructions: What a document or web page says is treated as content. Text inside a file cannot give an agent orders.
Numbers are checked: Figures come from code that ran, not from prose. An answer containing a number the run did not produce is refused.
Everything is written down: Each request, step and answer goes in a log, and each change to a saved connection records who and what kind, never the value.

Files stay at home. Copies cross only when a person sends them.

Release is the only way across: A person sees exactly what goes, to whom and until when, before it goes.
Their AI reads nothing by default: A release may allow it, naming the model. Each read is logged where both companies can see the question, files and model.
Each side's agents stay on their side: They run on their own company's model and search only what that person may see. A draft waits for a person.
A room has an end: One room for each engagement, and nothing passes between rooms. Closing one removes the shared copies for both sides.

A personal assistant hears more than a work tool, so the limits are stricter.

No voiceprints: No speaker enrolment, no identifying people by voice, and no voice cloning. Her wake word runs on your phone.
A write is confirmed first: There is no undo, so she reads back the specifics and waits for your yes before anything changes.
What she learns is yours: It is encrypted for you alone and can never be read by an organisation. It is deleted with your account.

If you find a security problem, or something here that is not true, write to contact@memoquid.com. The details are in our privacy policy and terms.