Cryptographic memory: encrypted, chained, shreddable

Key hierarchy

Every category of every memory has its own data key. Data keys are versioned and can be rotated on demand; each is bound to its owner, category and version when it is wrapped, so a key wrapped for one category can never be unwrapped for another. Unwrapped data keys exist only in memory, for a short, bounded time, on whichever side holds the master key for that memory: Agentu's platform, inside the request that answers your AI, when Agentu manages the keys (the default); your device when you hold your own keys; or, for Agentu Sealed during a grant, the sealed enclave. Master keys that Agentu manages live in a hardware-backed key store in Switzerland and are used only to answer a request you authorised; every such open is logged. Service keys that sign the hash chains and protect metadata live in a hardware-backed key store in Switzerland; they open no memory.

Key custody: managed by Agentu, your own keys, Sealed, Dedicated

The encryption is the same for everyone. What differs is who holds the master key that wraps the data keys. Agentu manages it by default, for personal and company accounts alike; anyone can press "Hold my own keys"; Agentu Sealed is the upgrade in build; Dedicated is the same choice on a single-tenant instance. This site marks each with its status.

Companies. A company chooses at sign-up: Agentu manages the keys, or the company holds its own, with the company root key split across a quorum of admin devices. How that works →

Honest limits. Managed by Agentu is not zero-access: the platform can open a memory to answer you, and a compromised live server during a request window could read what passes through it; nobody at Agentu reads memories, and every open is logged. Holding your own keys is zero-access but cannot be recovered without your phrase or kit. Sealed is not zero-access during a live grant: while your AI is allowed to read, Agentu's enclave holds a working key. Dedicated changes where and for whom the instance runs, not these limits. The interim one-click attach for Claude and ChatGPT that exists in the app today creates a project Agentu can read, says so on screen, and is not Sealed.

Glossary. Managed by Agentu: the default; Agentu manages the keys, memories are encrypted in Switzerland and opened by the platform only to answer your AI, every open logged. Hold your own keys (Sovereign custody): keys only on your devices, 24-word recovery phrase. Agentu Sealed: the upgrade, in build; the key in our vault only turns with your biometric and the enclave is the only reader, Biometric-Sealed Encryption. Dedicated: a single-tenant Agentu operated by Agentu in the region the customer chooses, Swiss hardware later, per deployment on request. Sealed enclave: a processing environment Agentu's staff cannot reach, where a Sealed working key lives for the length of a grant. Away grant: a time-limited key a device of yours releases so an AI can keep reading while the device is away. Agentu Bridge: the app on your computer that holds your key for local AI apps when you hold your own keys.

How an entry is sealed

Every memory is encrypted with AES-256-GCM under its category's data key, with a fresh random nonce. The entry's header — category, sequence number, timestamp, key version and provenance — is bound as additional authenticated data, so a ciphertext cannot be moved to another category, reordered or re-labelled without failing authentication. Tags and metadata are inside the sealed body, not beside it.

Tamper-evident history

Each category is an append-only chain. Every entry's hash commits to its header, to a digest of its sealed bytes and to the previous entry's hash; each hash is signed with an Ed25519 service key that is itself sealed under the key store. Appends are serialised per category, so there is exactly one history. Forgetting an entry removes its content but keeps its digest, hash and signature: the tombstone stays verifiable and the chain stays intact. The public signing keys are published at /v1/public-keys for anyone to check.

Provable deletion

Deleting a category, or a whole memory, schedules the destruction of its wrapped keys after a grace period during which the deletion can be cancelled. When the period ends the wrapped keys and sealed bodies are nulled. Because nothing under that key can be decrypted any more — including copies in backups and replicas — deletion is effective everywhere at once, across every jurisdiction the data ever touched. This is crypto-shredding, and it is how "right to erasure" is honoured without having to find every copy.

Access control

There are no passwords. Access is by keys with explicit scopes: read:<Category>, write:<Category>, read:*, write:* and manage. Keys are stored as SHA-256 hashes; the token is shown once. Every route checks scope and ownership; anything a key may not see is reported as not found, so out-of-scope categories are indistinguishable from non-existent ones. Claude, ChatGPT and other assistants connect through OAuth 2.1 with PKCE, receiving tokens that inherit a key's scopes and die when the key is revoked; developer tools and APIs use the key directly as a bearer token. Rate limits apply per IP and per key.

Export and independent verification

An export bundle contains your sealed entries, the wrapped category keys re-protected under a passphrase you choose (scrypt-derived), the chain hashes and the signing public keys. The agentu-verify tool checks the bundle's integrity and signatures offline and decrypts it with the passphrase — without Agentu being online, or existing.

What Agentu can and cannot see

• Never stores memory content, tags or metadata in plaintext: only ciphertext and the small header are at rest.
• When Agentu manages the keys (the default), the platform can open a memory, and does so only inside a request that answers your AI, logging every open. Nobody at Agentu reads memories; there is no screen, tool or support path that shows content. The limit is a compromised live server during the window of a request, and we do not call this zero-access.
• Cannot recover a key you hold yourself: Agentu's servers never hold one. Lose every device, the 24-word phrase and the recovery kit, and your recourse is the export you kept, not us.
• Cannot open a Sealed key on its own (in build): it is wrapped to your biometric passkey, and only your unlock releases a working key, into the enclave, for a bounded time.
• On a Dedicated instance, exactly the same, on an instance that serves one customer in the region they chose.
• Can see headers: category names, timestamps, sizes, provenance, and which keys are used when — enough to run the service, not enough to know what you remember.
• Decrypts only where the key is (Agentu's platform when it manages the keys, your device when you hold them, or the Sealed enclave during a grant you unlocked), only inside a request you authorised, and never writes plaintext to logs, audit records, metrics or error messages.
• The public website sets no cookies, loads nothing from third parties and keeps no signup e-mail — because it never asks for one.

What the AI models can and cannot keep

Agentu never uses your memory to train anything, and never lets anyone else. When a model you connect reads your memory, it receives only the snippets its key allows for that question. What the provider then does with those snippets is governed by its own terms, and we state them rather than wish them away. As of 1 October 2026, under the business and API terms Agentu uses:

So the precise promise is this: your data is never training data; nothing is stored by Agentu in the clear; a model sees only what you allowed for one question; and where a provider offers a zero-retention route we use it under contract. Where a provider keeps abuse-monitoring logs for up to 30 days, we say so. We do not say "wiped the instant your answer is back", because for some models and routes that is not what the contracts say.

Two things remain yours to decide. First, assistants you use through their own chat apps (claude.ai, ChatGPT, the Gemini app) keep their own conversation history under your or your organisation's settings — Agentu can revoke what they may read next, not delete what they already showed you. Second, every key says which models may read which categories, so the most sensitive category can be kept away from the model with the weakest terms.

Teams, projects, ID codes and leavers

For a business, categories are not six personal labels but the organisation's own structure: projects, client matters, departments, roles. Each is a separately keyed category. A person or an agent holds keys only for their slice; an AI app connected by that person inherits the same slice and nothing more. A company chooses at sign-up who holds its keys. Managed by Agentu, the default: project and company keys live in Agentu's Swiss key store, opened only to answer an allowed AI, every open logged, and recovered by the company's admins without any phrase. The company holds its own keys: the company root key is never stored whole but split across the admin quorum's devices (with an optional extra share in an HSM or vault the company chooses, never held by Agentu), so a quorum of admin devices recovers it. Either way, project keys are versioned, wrapped for each member device, and rotated when a person leaves. Outside the vault every person is an ID code such as AGU-7K3M-Q2X9; the mapping to a name is encrypted under its own key and shredded on removal. Removing a person revokes sessions and tokens, rotates project keys, shreds the identity mapping, and requests and evidences vendor deletion in the connected AI and enterprise systems, directly where a vendor offers an API and as a tracked request where it does not. When a project ends and its retention period expires, destroying the project key makes the data unreadable in every backup. In build for Agentu Professional, where many AIs work the same repositories at the same time under these keys; the cryptography underneath is the same as the live personal service. Agentu Professional →

Hosting, regions and operations

The shared service runs in Switzerland (AWS Zurich): one home for every memory, personal and business, under Swiss privacy law and outside both EU and US jurisdiction. Managed keys never leave the Swiss key store and open a memory only to answer a request; keys you hold yourself exist only on your devices; Sealed keys (in build) open only on your biometric. The location protects metadata and legal process while the cryptography protects the content. A Dedicated instance runs in the region the customer chooses, Swiss hardware later, operated by Agentu to the same standard. Regional homes in the United States and Singapore are in build for customers whose sector rules require in-country storage; a home is described as live only once it serves customers. See data residency for the current state and for which countries require in-country storage.

Infrastructure is defined as code, deployments go through a reviewed pipeline with a required human approval for production, database backups are encrypted and kept in Switzerland, and the service is built from portable parts (containers, PostgreSQL, a pluggable key store) so that Agentu can stand up a Dedicated instance in another region. Agentu does not publish deployment templates or offer self-hosting. Formal certifications (SOC 2, ISO 27001) are not yet in place and are not claimed; the plan and the insurance position are on the compliance page.

Reporting a vulnerability

Please write to security@agentu.com. Details, including our disclosure policy, are in /.well-known/security.txt. We acknowledge reports quickly and credit researchers who want to be credited.