mirror of
https://github.com/supermemoryai/supermemory.git
synced 2026-10-27 06:15:15 +00:00
23983bffae
Fixes billing, analytics, security and legacy reference pages. - **Operations.** `rewriteQuery`, rerank/aggregate and forget-matching each bill one operation. - **Profile metering.** v5 profile is documented as 1 search query per call. - **Analytics:** - The errors response shape is fixed. - Usage `byKey` includes `tokensUsed`, and the log `output` example has the right shape. - The 90-day range limit doesn't exist. - **Smaller fixes:** - Only 2 billing endpoints need an admin. - The `credits` response shape. - The 2FA gate is in the feature table. - The security page points to the one-call namespace delete for data erasure. - Container-tag merge takes several sources. - A stale "after API deploy" note is removed. Checked against the current API and the published SDKs (TS 5.0.1, Python 5.0.0). Legacy v3/v4 docs are unchanged apart from factual fixes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
88 lines
5 KiB
Text
88 lines
5 KiB
Text
---
|
||
title: "Security & compliance"
|
||
description: "How Supermemory protects data: encryption, isolation, SOC 2, GDPR, HIPAA BAA and deletion."
|
||
sidebarTitle: "Security & compliance"
|
||
icon: "/icons/hugeicons/shield-01.svg"
|
||
---
|
||
|
||
Supermemory stores long-horizon context about people and organizations. Security and compliance are part of the product surface, not a footer claim.
|
||
|
||
This page is the product-level trust overview. For multi-tenant design details, see [Namespaces](/concepts/container-tags) and authentication docs in the Developer Platform.
|
||
|
||
## Compliance posture
|
||
|
||
| Framework | Status | Notes |
|
||
|---|---|---|
|
||
| **SOC 2 Type II** | Certified | Independent audit of security controls. Available on production plans that advertise it (see [pricing](https://supermemory.ai/pricing); typically Scale and above for formal enterprise packaging). |
|
||
| **GDPR** | Compliant | EU personal data handled with care; support for access and erasure workflows. |
|
||
| **HIPAA** | BAA available | Business Associate Agreement available for eligible cloud plans (Scale / Enterprise). Cloud-only unless you self-host under your own controls. |
|
||
|
||
Need a report, DPA, or BAA? Contact [support@supermemory.com](mailto:support@supermemory.com) or your enterprise contact.
|
||
|
||
## Security controls
|
||
|
||
### Encryption
|
||
|
||
- **In transit:** TLS for API and console traffic
|
||
- **At rest:** Industry-standard encryption for stored data (AES-256 class controls in the managed cloud)
|
||
|
||
### Isolation and access
|
||
|
||
- **Namespaces** (what v3/v4 called container tags) enforce hard boundaries between users, tenants, or projects — the primary multi-tenancy primitive.
|
||
- **API keys** authenticate every request. Prefer **scoped keys** when a client or session must only touch one namespace.
|
||
- **Organizations** in the console manage members, keys, and billing separation.
|
||
|
||
A malicious or buggy client with a correctly scoped key cannot read another namespace’s memories.
|
||
|
||
### Data use
|
||
|
||
Supermemory is infrastructure for *your* agents. Your customer content is never used to train models — this applies to every plan, free or paid, with no difference between them. For contractual wording (DPA, subprocessors, training policies), request the latest legal pack from support.
|
||
|
||
### Data residency and deployment options
|
||
|
||
- **Managed cloud** — default multi-tenant SaaS.
|
||
- **Self-hosted binary** — the engine, storage, and default local embeddings run on your machine or VPC. If you configure remote LLM or embedding providers, their processing inputs are sent to those providers. See [Self-hosting](/self-hosting/overview).
|
||
- **Enterprise / dedicated** — for stricter residency, air-gap, or custom deployment requirements. See [Local vs Enterprise](/self-hosting/local-vs-enterprise).
|
||
|
||
## Privacy operations you should design for
|
||
|
||
### Deleting a user (right to erasure)
|
||
|
||
The practical GDPR-style path for app builders:
|
||
|
||
1. Scope each end-user (or tenant) to a **namespace**.
|
||
2. When the user requests deletion, use `DELETE /ns/{namespace}` with an org admin or owner credential that has write access. It deletes the namespace, its namespace-owned memory records, and documents exclusive to it; documents shared with other namespaces are retained. The default `sm_project_default` namespace cannot be deleted.
|
||
3. Revoke any **scoped keys** issued for that user.
|
||
|
||
Designing isolation up front still makes identifying the user's content easier.
|
||
|
||
### Connectors and third-party sources
|
||
|
||
OAuth connectors (Drive, Notion, Gmail, and others) pull content your users authorize. Disconnecting a connector stops future sync; you still control whether already-ingested documents remain in the memory store. Treat connector scope and retention as part of your product privacy policy.
|
||
|
||
### Self-host when cloud is not enough
|
||
|
||
If policy requires data never leave your network, run the [self-hosted engine](/self-hosting/overview). You bring the model endpoint (including fully offline OpenAI-compatible local models). Enterprise adds managed on-prem / dedicated options with organizational controls.
|
||
|
||
## Reliability and support
|
||
|
||
- Status and incidents are communicated through Supermemory’s status and support channels.
|
||
- Support depth scales with plan (community → email → priority → dedicated enterprise).
|
||
- Latency targets for retrieval are in the ~sub-300ms p50 range on the managed platform for typical search workloads; always validate on your traffic shape.
|
||
|
||
## Related
|
||
|
||
<CardGroup cols={2}>
|
||
<Card title="Billing & plans" icon="/icons/hugeicons/credit-card.svg" href="/overview/billing">
|
||
Which tiers include BAAs, seats, and self-host options.
|
||
</Card>
|
||
<Card title="Namespaces" icon="/icons/hugeicons/tag-01.svg" href="/concepts/container-tags">
|
||
How isolation works in the data model.
|
||
</Card>
|
||
<Card title="Authentication" icon="/icons/hugeicons/key-01.svg" href="/authentication">
|
||
API keys and access for the Developer Platform.
|
||
</Card>
|
||
<Card title="Self-hosting" icon="/icons/hugeicons/server-stack-01.svg" href="/self-hosting/overview">
|
||
Keep memory on your infrastructure.
|
||
</Card>
|
||
</CardGroup>
|