Security at Memoshelf

What we actually do, and what we do not claim.

Effective: Oct 13, 2026

Last updated: Oct 13, 2026

Questions or a vulnerability to report: security@memoshelf.com.

What we do

• Signed in everywhere. Every API and connector call needs a key or an authorized connection. Keys are shown once, stored only as a one-way hash, and can be revoked at any time. Connector codes and tokens are stored only as hashes too. Sign-in to the owner app is by emailed link; there are no passwords.
• Keys limited to one AI. You can limit a key or connection to one AI's lane. A limited key reads only that lane plus shared team notes, and writes only to its own lane.
• Accounts kept apart. Every keyed read and write is checked against the caller's own workspace, and the database refuses direct access from outside the app.
• Encryption. HTTPS everywhere, with HSTS. Your account data and content are stored in a database that our database provider encrypts at rest.
• Data in the United States. Your account data and content are stored in US East data centers.
• Rate limits and quotas. Requests are rate-limited with a shared store, and each plan has quotas. Over quota, requests are refused until your limits reset.
• Export and delete. Export your workspace on every plan. Deleted notes and runs can be recovered for 30 days, and a workspace deletion can be cancelled for 30 days; after that they are permanently removed. Deleting your account data removes it right away and cannot be undone.
• Rules pages kept. Pinned rules pages are not removed by any plan's retention limit.
• Signed webhooks. Outbound webhooks go only to public https addresses and are signed.
• Safe page fetching. Page fetches use public http(s) addresses only, honor robots.txt, refuse private and loopback addresses, and never store credentials or cookies.
• Analytics stay outside the app. Cookie-free page-view counts load only on public marketing pages, never in the signed-in owner app.
• We don't send your notes to AI providers. Memoshelf does not send your content to any AI model provider on its own. Your content goes only to the AI tools you connect, under those tools' own terms. We do not train on your content.

What we do not claim

• We have no SOC 2 report and no ISO 27001 certification, and we will not say otherwise.
• Memoshelf is not for protected health information (PHI) or other regulated records, and we do not sign business associate agreements.
• We do not publish an uptime number or a request-per-second number beyond the plan quotas in /pricing.json.

Memoshelf is run by a small team. This page lists what we do today; if something is not listed here, do not assume we do it. No system is perfectly secure, and we cannot guarantee security.

Data we refuse

We do not read note bodies as operators. If health, payment-card, government-ID or other regulated data is reported to us, we delete the reported notes or workspace on the account holder's request, or on our own decision under the Terms, without inspecting the content, and we tell the account holder by email.

Report a vulnerability

Email security@memoshelf.com with what you found and how to reproduce it. Test only against your own account and data. Do not access other customers' data, and do not disrupt the Service (no denial-of-service or spam testing). We do not offer a paid bug bounty.