For procurement and security review

The answers your review asks for

In the shape the questionnaire asks them, with what we do not have yet named as plainly as what we do. If something here is not enough for your process, write to us and ask.

Hosting and data residency.

Hosted deployment: Run by us on Hetzner Online GmbH, in Germany (EU), with each firm's data kept separate from every other firm's. You start with a free pilot. Published through a Cloudflare tunnel, so the origin has no inbound ports open and its address is never advertised.
Private cloud: The same software, run by us in an environment isolated for your firm alone. It starts with a paid pilot.
Self-host: The whole system inside your perimeter, as a compose bundle with a runbook. Nothing leaves it except what the egress allowlist names, and by default that is the model endpoint alone. An empty allowlist cuts every outbound call, but with no model nothing new is read, so the memory answers only from what was read before.
Sub-processors: Named individually, with purpose and location, on the sub-processor register. We give notice before that list changes.

Tenant isolation.

Model: One database schema and one object-store prefix per firm. Not row-level security, and not a shared table with a customer column: every query names its schema in full, so there is no configuration that could silently widen it.
Database enforcement: Required on our hosted service, and available but off by default on a deployment you run: each firm's data queries run as a Postgres login role privileged on only its own schema, so the boundary is enforced by the database rather than by our code being correct. A firm whose role is missing is refused, never served on a shared one.
Within a firm: Answers are trimmed to each person's permissions in the source systems, including everything derived from a document. See what we enforce.
Revocation: A permission removed at the source is followed within the sync interval (five minutes by default), including for derived facts. The trust page lists which sources carry per-document permissions.

Identity and access.

Agent access: OAuth 2.1 in front of one MCP endpoint per firm, with per-person identity behind it. No shared API key and no service account standing in for a team. See the connection.
Single sign-on: OIDC federation is shipped. SAML and SCIM are not built yet — if your process requires either, say so before you evaluate rather than after.
Directory sync: An identity provider's groups can become a firm's memberships. A grant can come from the directory or from an administrator, and it ends when every source that granted it has revoked it.
Impersonation: There is no impersonation path. Support cannot read a customer's memory as a customer's user, because the door does not exist.

Data handling.

In transit: TLS on every external connection.
At rest: Encrypted at the storage layer of the hosting provider. Source credentials are held in a vault and are never echoed back to an administrator once stored.
Model training: Your documents are read to build your memory and for nothing else. Model calls run under enterprise terms that exclude training; on private cloud they run on our keys, or your own if you prefer, and on self-host under your own keys.
Retention: What we hold is named field by field on the privacy page. Deleting a firm destroys it; see Deletion.
Deletion: On request, your firm's data is destroyed down to the credentials. Because isolation is physical, deleting a firm is deleting its schema and its object-store prefix rather than a filtered sweep of a shared table.
Processing terms: Our data processing agreement covers hosted, private cloud and self-host.

Certifications, and what we do not have.

Current status: None yet. Nemosyne holds no SOC 2 or ISO 27001 certification today.
Penetration testing: None yet. No independent penetration test has been run.

The read log is an export, not yet a screen in your console — see this and six other limits on the trust page.

Reporting something, or asking for more.

Security reports and questionnaire follow-ups go to [email protected]. If you have found something, tell us what you found and how to reproduce it; we will confirm receipt and tell you what we are doing about it. We do not run a bug bounty.