Security and data flow

Memrain runs in your AWS account, and nobody operates it for you. This page says what stays there, what leaves, and which parts are still your job.

Data flow

One Terraform stack per deployment. The only content that leaves AWS is what your agent retrieves, on its way to that agent's model.

Memrain data flow An AI agent client sends an HTTPS MCP request with its credential through the Cloudflare Tunnel edge, or through Caddy on the instance in Caddy mode, to the memrain container on one EC2 instance in your AWS account. The container reads and writes RDS Postgres with pgvector and EFS, reads Secrets Manager at boot, writes CloudWatch logs, and calls Bedrock Titan v2 for embeddings in the stack region. CloudTrail records AWS API calls. Opt-in features call Bedrock Claude through an EU cross-region inference profile. Retrieved passages return through the same ingress to the client, which sends them to its own model provider to write the answer: the one content flow that leaves AWS. Outside your AWS account Your AWS account (one region) AWS, EU regions (opt-in) Cloudflare Tunnel edge default ingress AI agent client Claude, ChatGPT, Codex Agent's model provider writes the answer EC2 instance memrain container MCP, OAuth, admin Caddy on the instance alternative ingress, TLS RDS Postgres 16 + pgvector encrypted, 7-day backups EFS config, identity files Secrets Manager read at boot CloudWatch Logs app logs, 14-day retention CloudTrail to S3 on by default, 90 days Bedrock Titan v2 embeddings, stack region Bedrock Claude Haiku, Sonnet EU cross-region inference profile HTTPS request + credential outbound tunnel, tcp 7844 Caddy mode retrieved passages the one content flow that leaves AWS Outside your AWS account Agent's model providerwrites the answer retrieved passages the one content flow that leaves AWS AI agent clientClaude, ChatGPT, Codex HTTPS request + credential Caddy mode Cloudflare Tunnel edgedefault ingress Your AWS account (one region) outbound tunnel, tcp 7844 EC2 instance Caddy on the instancealternative ingress, TLS memrain containerMCP, OAuth, admin RDS Postgres 16 + pgvectorencrypted, 7-day backupsEFSconfig, identity filesSecrets Managerread at bootCloudWatch Logsapp logs, 14-day retentionCloudTrail to S3on by default, 90 daysBedrock Titan v2embeddings, stack region AWS, EU regions (opt-in) Bedrock Claude Haiku, SonnetEU cross-region inference profile
Stored data stays in the shaded area. Requests and responses use the same ingress.

What stays, what leaves

Stored data stays in your AWS account. Passages your agent retrieves go to that agent's model, under your agreement with that provider. With the default Cloudflare Tunnel, requests pass through Cloudflare. Caddy mode takes Cloudflare out of the path.

FlowWhat it carriesLeaves your AWS account?
Agent client to ingressThe MCP request and its credentialYes, on the way in. Through Cloudflare in Tunnel mode, direct in Caddy mode.
Memrain to RDS and EFSPages, chunks, embeddings, facts, configNo. Encrypted storage.
Memrain to Bedrock Titan v2Chunk and query text, for embeddingsNo. Bedrock in your account.
Memrain to Bedrock ClaudeQuery or chunk text, only for opt-in featuresStays in AWS, within the EU regions of the inference profile.
Response to your agentRetrieved passages with source pointersYes. Your agent sends them to its model to write the answer.
Telemetry to a vendorNothingNo vendor analytics, no third-party telemetry.

Model calls

Embeddings come from Amazon Titan v2 on Amazon Bedrock in your AWS account. Optional Claude calls (Haiku 5.5, Sonnet 5.5) use EU cross-region inference profiles by default, and IAM denies Claude invocation outside the allowed regions.

Telemetry

No vendor analytics and no third-party telemetry. Memrain keeps its own usage counters (aggregate search telemetry, request and spend logs) and CloudWatch application logs with 14-day retention, all inside your account.

Secrets

Runtime credentials live in AWS Secrets Manager. Terraform generates the initial database password, the public bearer and the internal token, so those values are also in your Terraform state. Keep the state bucket encrypted and access-restricted.

People and credentials

Each person gets their own credential: a personal access token, or a one-time enrollment code redeemed through your organisation's connector. You can revoke one person without touching anyone else.

The connector is a built-in OAuth 2.1 authorization server with PKCE. It is not single sign-on: there is no SAML, no OpenID Connect federation and no SCIM.

Credential changes are recorded: who issued, revoked or replaced an enrollment, and who changed a grant. A per-request log is opt-in and has no retention limit yet. CloudTrail is on by default in the Terraform stack, with 90-day S3 retention, and can be turned off. The admin panel has its own sign-in and a strict Content-Security-Policy.

Spend caps on model calls

Daily USD caps per connector, token or person, plus an optional brain-wide daily cap. Caps apply to priced model calls, and some costs are approximations, so treat a cap as a control and keep an eye on the AWS bill.

Redaction on ingest

Credential-shaped text is redacted before it is stored: vendor keys, JWTs, PEM private keys, passwords in URLs, Basic and Bearer credentials, and high-entropy KEY= or TOKEN= assignments. Imported chat history is redacted on the way in too.

Retrieval output to non-operator callers is scanned and redacted, and memrain secrets audit rescans what is already stored. No pattern set is complete, so rotate a leaked credential first.

Isolation is application-layer

Each person can have a private space (a source). Enforcement is in the application layer. It is pilot-grade: it needs MEMRAIN_TENANT_FAIL_CLOSED=1 and Dynamic Client Registration off, and its known limits are documented.

If you need legally required separation, run one stack per team.

Network access

With the Cloudflare Tunnel, the instance opens no inbound ports. SSH is off unless you allow a CIDR, and SSM Session Manager is the default access path. Caddy mode opens HTTPS on the instance.

Optional VPC interface endpoints for Bedrock, Secrets Manager, SSM and CloudWatch Logs keep AWS API traffic on the AWS network. They cost about $43 a month extra and are off by default.

Backups

RDS automated backups with 7-day retention, encrypted storage, deletion protection and a final snapshot on destroy. RDS runs single-AZ, on one EC2 instance. High availability is not offered.

A restore drill, RTO and RPO are not provided. Run a restore in your pilot and write down your own figures.

Reporting a vulnerability

Please do not open a public issue. Report privately through GitHub's private vulnerability reporting: the repository's Security tab, then Report a vulnerability. Expect a first reply within five business days, and coordinated disclosure once a fix lands. That is a target, not an SLA.

There is no third-party audit or compliance attestation. The code is open for your own review.

Open the Security tab Read SECURITY.md