Security

Security reviews

If you are assessing Auld for procurement, send your questionnaire or the controls you need described to support@auld.app. The sections below summarize how the service is designed to handle data.

How the API handles your data

• Project isolation: memory never crosses projects; every key belongs to one project.
• Viewer-scoped recall: visibility is enforced on every recall, including MCP and plugin calls.
• Deletion: deleting a record removes memories that depend only on it; identity and project deletion are available.
• No training on your data: your records are not used to train general models.
• Encryption: the service is designed to encrypt data in transit and at rest.

Identity and access

• Key types with different powers: secret, recall-only, MCP.
• Per-token tool controls and expiry for MCP.
• SSO and SAML for console access on Enterprise.
• Request logs with key and identity for every call.

Deployment options

Enterprise agreements can keep the memory store — or the whole engine — in your own AWS, Google Cloud or Azure account. See Enterprise.

What you control

• What you send, and its visibility.
• Key creation, rotation and revocation.
• Retention through deletion calls and plan retention settings.
• Which identities belong to which audiences.

Responsible disclosure

Report suspected vulnerabilities to support@auld.app with “Security report” in the subject. Include steps to reproduce and affected endpoints. Please don’t access other users’ data, degrade service, or publicly disclose before we have responded.

Frequently asked questions