no foundation-model training on your data — contractual · tenant isolation enforced at the database layer · following SOC 2 Type II standards, certification on the roadmap.
your commitments, decisions, and the exact phrases you used to save them never go to a foundation model — not ours, not a third party's. we will not sell your data. if we ever aggregate it to improve the product itself, we will tell you before we do, in writing, with a way to opt out.
nothing is saved passively. capture happens as you work — your assistant calls the remember tool over MCP when something worth keeping comes up, or you ask it to save a specific commitment. 3ngram stores only what was flagged — your words, the timestamp, the source.
on the roadmap, not live today. when sync ships: merged PRs, review comments, issue rationale — the decisions you committed to code.
on the roadmap, not live today. when sync ships it will be project-scoped, per-surface — disconnect any source and ingestion stops immediately, with existing imports subject to your retention settings.
on the roadmap, not live today. when sync ships: only the files you pick through the Google Picker, and the calendars you grant. per-file consent for docs — we can't see anything you didn't hand us.
on the roadmap. not live today. when they ship, scope will be as narrow as everything above — sent-folder only for gmail, channel-by-channel for slack, and transcripts you invoke for granola.
every table containing user data enforces row-level isolation at the database layer, not just in application code. even if application logic has a bug, the database itself prevents cross-user data access.
all data is encrypted at rest. integration tokens — the credentials for your connected services — are additionally encrypted at the application layer before storage. all connections use TLS.
no employee can read your captures without a signed support request from you. every privileged access is written to an append-only audit log that the application cannot modify or delete.
hard-delete from Settings removes your memories, documents, clusters, and OAuth tokens. the deletion itself is recorded in the audit log. soft-deleted items are permanently removed on a 30-day default window.
your data is stored in a managed database hosted in the EU. 3ngram is operated by a Danish company; your data controller is in the EU. sub-processor details are available on request.
for how memories are stored, superseded, and deleted, see the memory model docs.