scriptoriumadmin/supermemory
1
0
Fork 0
mirror of https://github.com/supermemoryai/supermemory.git synced 2026-10-27 06:15:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

docs: correct self-hosted release security and privacy claims

Browse source
This commit is contained in:
Dhravya 2026-09-28 21:16:10 +00:00
parent cfa6c7cb17
commit f11e8e6a38
No known key found for this signature in database
GPG key ID: AB7AE7EA7D4AF7AD
4 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -336,7 +336,7 @@ const client = new Supermemory({
- **Bring any model** — OpenAI, Anthropic, Gemini, Groq, or any OpenAI-compatible endpoint. An interactive wizard walks you through it on first boot.
- **Embeddings** — local `Xenova/bge-base-en-v1.5` by default (no API key); optionally OpenAI, Gemini, or Ollama. Same provider stack as cloud.
- **Fully offline if you want** — point it at Ollama (`gpt-oss:20b` works great) and nothing leaves your machine.
- **Offline text memories if you want** — point it at Ollama (`gpt-oss:20b` works great), disable telemetry (`SUPERMEMORY_DISABLE_TELEMETRY=1` on the current v0.0.8 release), and use local text or file inputs after the first embedding-model download. URL ingestion uses a hosted reader service.
- **Your data, one directory** — everything lives in `./.supermemory`, easy to back up or move.
- **Same API as the platform** — prototype locally, ship on the hosted platform by changing `baseURL`.

12
apps/docs/self-hosting/configuration.mdx
View file

@ -14,8 +14,12 @@ The installer writes API keys to `~/.supermemory/env`, which is loaded on every
| Variable | Purpose | Default |
|---|---|---|
| `PORT` (or `SUPERMEMORY_PORT`) | HTTP listen port | `6767` |
| `SUPERMEMORY_HOST` | In the next release, controls the listen address; not supported by v0.0.8 | `127.0.0.1` in the next release |
| `SUPERMEMORY_ALLOW_LOOPBACK_AUTH` | In the next release, opt into unauthenticated direct loopback requests; unsafe behind a same-host reverse proxy | unset in the next release |
| `SUPERMEMORY_DATA_DIR` | Where the graph engine's data, auth secret, and model cache live | `./.supermemory` |
**The currently published v0.0.8 binds all interfaces and its implicit local authentication is unsafe when exposed to untrusted networks. Do not expose it; restrict access with a firewall or run it on an isolated machine.** The next release will bind loopback and require the generated key for every API request by default, including requests from localhost. Its browser welcome page will no longer reveal the key; enter the key printed at first boot in the Memory tab. When you later expose that release through a reverse proxy, leave loopback auto-auth disabled and protect the endpoint with TLS and access controls.
## LLM providers
In production, Supermemory uses its own proprietary models tuned for long-horizon data understanding. Self-hosted, you bring your own LLM for the intelligent steps — summaries, contextual chunking, and memory extraction. Embeddings default to a local model (no API key) and can optionally use OpenAI, Gemini, or Ollama — see [Embeddings](/self-hosting/embeddings). Configure **at least one** LLM provider:
@ -118,11 +122,15 @@ Raise the limit and concurrency on machines with spare RAM for faster bulk impor
## Telemetry
The self-hosted binary sends no analytics — there is nothing to opt out of. The only related switch:
**Important for the currently published v0.0.8 binary:** telemetry is enabled by default. It sends fleet heartbeats and memory-agent AI events, including full prompts, outputs, and tool state, to Supermemory's Self-hosted PostHog project. Set `SUPERMEMORY_DISABLE_TELEMETRY=1` before starting v0.0.8 if this content must stay on your machine. A future release will make telemetry opt-in; this change is not in v0.0.8.
| Variable | Purpose | Default |
|---|---|---|
| `SUPERMEMORY_DISABLE_TELEMETRY` | Set to `1` to also disable internal AI SDK telemetry instrumentation | unset |
| `SUPERMEMORY_ENABLE_TELEMETRY` | In the next release, set to `1` or `true` to opt in; not supported by v0.0.8 | unset |
| `SUPERMEMORY_DISABLE_TELEMETRY` | Set to `1` or `true` to stop this telemetry, including on v0.0.8 | unset |
| `SUPERMEMORY_POSTHOG_API_KEY` / `SUPERMEMORY_POSTHOG_HOST` | Optional destination overrides | Supermemory Self-hosted PostHog |
When enabled (by default on v0.0.8), telemetry sends a boot and six-hourly fleet heartbeat (version, OS/arch, configured provider and embedding model ids, database mode, uptime) and memory-agent `$ai_generation`, `$ai_trace`, and `$ai_span` events. Those events include model, token and latency data, **full prompts and outputs**, tool names and definitions, and input/output state. An installation is identified by a random id stored in `$SUPERMEMORY_DATA_DIR/instance-id`.
## Platform-only features

2
apps/docs/self-hosting/local-vs-enterprise.mdx
View file

@ -5,7 +5,7 @@ description: "Supermemory local is for builders. Supermemory Enterprise is for o
icon: "building-2"
---
Supermemory local — the self-hosted binary — is free, open source, and built for individual developers: local-first workflows, prototyping, air-gapped experiments, privacy-sensitive side projects.
Supermemory local — the self-hosted binary — is free within its lite license limit and built for individual developers: local-first workflows, prototyping, and privacy-sensitive side projects. Its server source is not in the public repository. Text-memory processing can run offline after the first embedding-model download; URL ingestion uses a hosted reader service.
**Supermemory Enterprise** is the full platform, run for your organization: the same memory engine with proprietary models, organizational controls, and infrastructure that scales with you — without you operating any of it.

6
apps/docs/self-hosting/overview.mdx
View file

@ -17,7 +17,7 @@ npx supermemory local
```
</CodeGroup>
No Docker. No database to provision. No config files. It boots in seconds with everything built in, and it's [open source](https://git.new/memory).
No Docker. No database to provision. No config files. It boots in seconds with everything built in. The SDKs and other components in the [public repository](https://git.new/memory) are open source; the downloadable self-hosted server binary is built from a separate, non-public codebase.
## Zero config, actually
@ -41,7 +41,7 @@ OPENAI_MODEL=gpt-oss:20b \
supermemory-server
```
Local graph engine, local embeddings, local LLM. Your data never leaves the building.
Local graph engine, local embeddings, local LLM. Text-memory processing can stay on your machine after the embedding model's first download when telemetry is disabled. **The currently published v0.0.8 enables content-bearing telemetry by default; set `SUPERMEMORY_DISABLE_TELEMETRY=1` before starting it.** URL ingestion uses a hosted reader service; use local text or file inputs for offline operation.
## Drop-in with your existing code
@ -58,7 +58,7 @@ Everything in the [Memory API docs](/quickstart) works the same way. The coding
## Self-hosted vs. the platform
Self-hosted is free, open source, and great for local development, air-gapped environments, and privacy-sensitive workloads. The hosted platform is where the full product lives:
Self-hosted is free within its lite license limit and useful for local development and privacy-sensitive workloads. The server binary is not open source; the hosted platform is where the full product lives:
| | Self-hosted | Platform |
|---|---|---|