supermemory·Security
Security and compliance
supermemory is SOC 2 Type II certified, with a HIPAA BAA on Scale and Enterprise and GDPR compliance. Your content is encrypted in transit and at rest, isolated per organization, and never used to train models. It is stored in the United States by default; dedicated, self-hosted and air-gapped deployments cover other requirements.
Compliance
| Framework | Status | What it means |
|---|---|---|
| SOC 2 Type II | Certified | Independent audit of our security controls, re-audited every year. The report is available from the trust center. |
| HIPAA | BAA available | A Business Associate Agreement is available on the Scale and Enterprise plans. |
| GDPR | Compliant | Access and erasure requests are honored within 30 days, and a DPA is available. |
supermemory is also penetration-tested by a third party, TAC Security; the most recent test was in November 2025. Controls are monitored continuously in Vanta.
How we handle data
- No training on your content. Customer content is never used to train models, on any plan.
- Encryption. TLS 1.3 for every API connection; AES-256-GCM at rest, with keys specific to each organization.
- Isolation. Each organization's data is separated logically and cryptographically. Inside an organization, namespaces are hard boundaries between users, tenants or projects, and scoped API keys limit a client to one namespace.
- Access. Employees cannot read raw ingested content. Access to account data is limited, logged and auditable, and every system requires multi-factor authentication.
- Audit logs. Data access and changes are logged and kept for at least 90 days; enterprise customers can request them.
Where data lives
Customer data is stored in the United States by default, in PlanetScale's database and on Cloudflare's network. For EU, UK or other residency requirements, Enterprise customers get dedicated deployments. supermemory also runs outside our cloud: as the free supermemory local binary on your machine, in your own cloud on Scale and Enterprise, and fully air-gapped on Enterprise. The pricing page and the self-hosting docs have the details.
Retention and deletion
| Data | Kept |
|---|---|
| Active customer data | As long as the account is active |
| Deleted content | Removed from production within 30 days |
| Encrypted backups | 90 days, for disaster recovery |
| Request logs | 90 days, for security and debugging |
| Closed accounts | All data, backups included, deleted within 30 days |
To erase one end user, scope them to a namespace and call DELETE /ns/{namespace}; the security docs describe what it removes. Disconnecting a connector stops its sync and, by default, deletes the documents it imported.
Incidents and continuity
- Monitoring and alerting run around the clock, with triage within an hour of detection.
- Affected customers are told within 24 hours of a material incident. Status is on status.supermemory.ai, and post-incident reports are published, like the October 18, 2025 report.
- Databases replicate across availability zones, with full snapshots every 4 to 6 hours. The recovery targets are under an hour of data loss and service back within 4 hours, against a 99.9% uptime target.
Subprocessors
| Subprocessor | Used for |
|---|---|
| Cloudflare | Network, DDoS protection and edge computing |
| PlanetScale | Primary database, United States |
| TurboPuffer | United States |
| Stripe | Payments processing, United States |
The trust center keeps the full, current list. Enterprise customers are told 7 days before it changes.
Documents and contacts
- The SOC 2 report, policies and controls are on the trust center.
- For a DPA, a BAA or a security questionnaire, write to security@supermemory.com.
- To report a vulnerability, see responsible disclosure.
Questions
Is supermemory SOC 2 compliant?
Yes. supermemory is SOC 2 Type II certified and re-audited every year. The report is available from the trust center.
Does supermemory sign a HIPAA BAA?
Yes. A Business Associate Agreement is available on the Scale and Enterprise plans.
Is supermemory GDPR compliant?
Yes. supermemory honors data access and erasure requests within 30 days, and a DPA is available.
Does supermemory train models on my data?
No. Customer content is never used to train models, on any plan, free or paid.
Where is my data stored?
In the United States by default, with PlanetScale and Cloudflare. Enterprise customers with EU, UK or other residency requirements get dedicated deployments, and supermemory also runs in your own cloud or fully air-gapped.
How do I delete a user's data?
Scope each end user to a namespace and call DELETE /ns/{namespace}. Deleted content leaves production within 30 days, and encrypted backups age out after 90 days.