Security Policy
Responsible disclosure
Section titled “Responsible disclosure”If you find a security vulnerability in MemStrata software or infrastructure, please email security@memstrata.dev.
- We aim to acknowledge all reports within 24 hours.
- We target a patch or mitigation within 7 days for critical issues.
- We will not take legal action against researchers who follow this policy.
PGP public key is available on our GitHub repository.
Architecture security guarantees
Section titled “Architecture security guarantees”What runs locally
Section titled “What runs locally”The following never leaves your machine by design — it’s an architectural constraint, not a policy:
- All source code and codebase graph data (
~/memstrata/index.db) - All AI prompts you send and responses you receive
- All session telemetry and savings metrics (
~/memstrata/telemetry.db) - Your LLM provider API keys (stored in OS keychain)
The local harness listens on localhost:8080 only — it is not bound to external network interfaces.
Network communications
Section titled “Network communications”The only outbound network call MemStrata makes is to memstrata.dev/lic for license verification. This call transmits:
| Data | Format |
|---|---|
| Subscription ID | Opaque UUID, not email |
| Hardware ID hash | HMAC-SHA256, salted per-license |
| JWT expiry | Timestamp only |
| MemStrata version | Semver string |
No source code, prompts, file paths, or API keys are transmitted.
License server
Section titled “License server”- Deployed on Cloudflare Workers — no persistent storage of code or prompts
- Hardware ID hashes are stored salted and cannot be reversed to raw hardware identifiers
- License verification logs retained 90 days, then purged
- All communication over TLS 1.3 with HSTS
Known limitations
Section titled “Known limitations”- The browser extension requires
host_permissionsfor supported AI provider domains. These permissions are used only to capture chat text and send it to the local harness. Review the extension source on GitHub. - The harness proxy does not validate TLS certificates for
localhostconnections (expected behavior for local services).
SOC 2 Type II is planned for V7 (post-Series A). If you need a security questionnaire completed for a procurement process, email security@memstrata.dev and we’ll provide our architecture documentation and respond to specific controls.
Bug bounty
Section titled “Bug bounty”We do not currently run a formal bug bounty program. Researchers who responsibly disclose valid vulnerabilities will be publicly credited (if they wish) in the release notes.