> ## Documentation Index > Fetch the complete documentation index at: https://supermemory.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security & compliance > How Supermemory protects data — encryption, isolation, SOC 2, GDPR, HIPAA BAA, and deletion. Supermemory stores long-horizon context about people and organizations. Security and compliance are part of the product surface, not a footer claim. This page is the product-level trust overview. For multi-tenant design details, see [Container tags](/docs/concepts/container-tags) and authentication docs in the Developer Platform. ## Compliance posture | Framework | Status | Notes | | ----------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SOC 2 Type II** | Certified | Independent audit of security controls. Available on production plans that advertise it (see [pricing](https://supermemory.ai/pricing); typically Scale and above for formal enterprise packaging). | | **GDPR** | Compliant | EU personal data handled with care; support for access and erasure workflows. | | **HIPAA** | BAA available | Business Associate Agreement available for eligible cloud plans (Scale / Enterprise). Cloud-only unless you self-host under your own controls. | Need a report, DPA, or BAA? Contact [support@supermemory.com](mailto:support@supermemory.com) or your enterprise contact. ## Security controls ### Encryption * **In transit:** TLS for API and console traffic * **At rest:** Industry-standard encryption for stored data (AES-256 class controls in the managed cloud) ### Isolation and access * **Container tags** enforce hard boundaries between users, tenants, or projects — the primary multi-tenancy primitive. * **API keys** authenticate every request. Prefer **scoped keys** when a client or session must only touch one container. * **Organizations** in the console manage members, keys, and billing separation. A malicious or buggy client with a correctly scoped key cannot read another container’s memories. ### Data use Supermemory is infrastructure for *your* agents. Paid production usage is not treated as free training corpus for unrelated public models. For contractual wording (DPA, subprocessors, training policies), request the latest legal pack from support. ### Data residency and deployment options * **Managed cloud** — default multi-tenant SaaS. * **Self-hosted binary** — full engine on your machine or VPC; embeddings and storage stay where you run it. See [Self-hosting](/docs/self-hosting/overview). * **Enterprise / dedicated** — for stricter residency, air-gap, or custom deployment requirements. See [Local vs Enterprise](/docs/self-hosting/local-vs-enterprise). ## Privacy operations you should design for ### Deleting a user (right to erasure) The practical GDPR-style path for app builders: 1. Scope each end-user (or tenant) to a **container tag**. 2. When the user requests deletion, delete that container’s content via the API / console workflows for documents and memories under that tag. 3. Revoke any **scoped keys** issued for that user. Designing isolation up front makes erasure a single boundary operation instead of a forensic search. ### Connectors and third-party sources OAuth connectors (Drive, Notion, Gmail, and others) pull content your users authorize. Disconnecting a connector stops future sync; you still control whether already-ingested documents remain in the memory store. Treat connector scope and retention as part of your product privacy policy. ### Self-host when cloud is not enough If policy requires data never leave your network, run the [self-hosted engine](/docs/self-hosting/overview). You bring the model endpoint (including fully offline OpenAI-compatible local models). Enterprise adds managed on-prem / dedicated options with organizational controls. ## Reliability and support * Status and incidents are communicated through Supermemory’s status and support channels. * Support depth scales with plan (community → email → priority → dedicated enterprise). * Latency targets for retrieval are in the \~sub-300ms p50 range on the managed platform for typical search workloads; always validate on your traffic shape. ## Related Which tiers include BAAs, seats, and self-host options. How isolation works in the data model. API keys and access for the Developer Platform. Keep memory on your infrastructure.