Security

A page like this usually lists certifications. This one starts with what is missing, because a memory service is asking to be trusted with the things you told your agents, and a reader deciding whether to trust it is better served by an accurate picture than an impressive one.

What this is not

• Not SOC 2, ISO 27001 or HIPAA certified. No audit has been performed. If a compliance questionnaire requires one of these, the honest answer today is no.
• No uptime SLA on the Cloud plan. The service runs on a single server.
• No SSO, and no organisation level access control yet. An account is one login and its keys.
• No redaction before write on the Cloud plan. A secret an agent writes into a fact is stored as written.

What is in place

• TLS everywhere. HTTPS is enforced and HTTP redirects to it. Certificates are issued by Let's Encrypt and renewed automatically.
• The database is not reachable from the internet. It listens only on a private container network; no port is published.
• API keys are stored hashed and shown once, at creation. Passwords are hashed and never stored in the clear. Both can be revoked and rotated by you.
• Every account is scoped. Reads and writes are filtered by the account behind the presented key, and every fact records the agent that wrote it and the reads that returned it.
• Secrets are not in the image. Configuration is injected at runtime; the server has no interactive login and is administered through AWS Systems Manager rather than a standing SSH key.
• Daily backups of the database.
• The engine is open source. The read and write paths can be audited by anyone, which is a stronger claim than a badge: read them.

If you self host

Nothing leaves your machine, and none of the above is ours to get wrong. The database is yours, the keys are yours, and the trade is that patching and backups are yours too.

Reporting a vulnerability

Email hello@echo-mem.com with security in the subject. Please include enough to reproduce it. We will acknowledge within 72 hours and tell you what we intend to do and when.

Please do not run automated scanners against the hosted service, access an account that is not yours, or degrade the service for other people while testing. There is no bug bounty: this is a small project and it would be dishonest to imply a payout process exists. Credit in the release notes is offered, if you want it.

Roadmap

Organisation scoping, SSO and redaction before write are the next security features, and are the substance of the Enterprise tier. They are listed as planned on the pricing page rather than as available.