Clear security boundaries.

Memory is useful because it persists. Its access controls should be just as deliberate.

Authentication and permissions

Clerk verifies identity. MarkdownMem checks the workspace, store, and requested action before accessing content. Workspace invitations use the person's verified email; a workspace administrator does not automatically receive content access to every private store.

Encryption at rest

The engine encrypts memory content before storing it. The service holds the keys required to decrypt authorized requests. This is service-managed encryption, not end-to-end encryption, and paths and control-plane metadata are not described as encrypted content.

Isolation and change integrity

Tenant-scoped references and integrity checks protect the relationship between workspaces, agents, and memory. Writes use versions and idempotency keys to prevent silent overwrites and duplicate operations.

Preview limits

MarkdownMem is currently a development preview. Do not use it as your only copy of important information, or store credentials, regulated records, or highly sensitive personal data in the preview. Recovery verification is part of the launch checklist.

Open engine

You can inspect the storage and authorization foundation in the public engine repository. We do not claim certifications or audits that have not been completed.