Security · Memorylayer

Security posture

Small surface, clear boundaries.

Memorylayer keeps the service model narrow: GitHub identity, workspace-scoped keys, hashed secrets, audit trails, and Postgres-backed isolation.

No passwordsGitHub OAuth handles user authentication.

Scoped keysWorkspace API keys can be revoked independently.

AuditabilityMemory writes, bridge calls, invites, keys, and usage are recorded.

The current controls are designed to be understandable and inspectable.

Area	Current behavior	Operator action
Identity	GitHub OAuth only; no service-side passwords.	Use GitHub account controls and organization policy.
API keys	Tokens are shown once, stored as hashes, and scoped to one workspace.	Use separate keys per agent or integration.
Revocation	Keys can be revoked from the workspace dashboard.	Rotate keys when an integration changes hands.
Isolation	Each workspace uses its own Engram schema.	Create separate workspaces for separate projects or teams.
Usage	Authenticated calls are recorded with route, key, status, and timestamp.	Review usage before rotating or deleting keys.
Audit	Workspace actions and bridge calls write audit entries.	Use the audit feed to explain state changes.

Hosted memory is durable infrastructure. Store useful context, not secrets.

Use secret managers for API keys, credentials, and tokens. Memorylayer is for context.

Prefer decisions, outcomes, file paths, and verified state over vague transcripts.

Separate keys make usage trails readable and revocation safe.