Keep access keys separate from working knowledge.
An assistant needs context and a permitted connection. Memrain separates the deployment's runtime secrets, each client's access and the material written into memory so their responsibilities stay clear.
Illustrative example
Where should a connection token go when I set up a new assistant?
Configure it through the client's supported connection path. Keep credentials out of saved notes, and issue access with the sources and scopes that client needs.
Illustrative scenario, not a live product result.Keep server secrets under operator control.
The documented AWS deployment stores runtime credentials in Secrets Manager. Initial database and service secrets also exist in Terraform state, which needs restricted access and encryption. The operator manages those systems separately from the knowledge store. Memrain's secret handling concerns its own deployment and supported import paths; credentials for unrelated applications remain with the connected tool or execution environment that uses them.
Give people their own connection.
Personal tokens and OAuth support individual client access. A shared organization connector can use enrollment mode, where a single-use, expiring code binds a person's authorization to their source. The code is shown once and its hash is retained. Its holder must keep it private until redemption; the operator can revoke an unused code or an established grant independently.
Screen what enters memory.
Write paths scan for credential-shaped content and redact it by default before storage. Operators can audit older content, and retrieval to non-operator callers has an additional redaction layer. Screening is a useful backstop rather than a reason to store secrets in notes. If a live credential was exposed, rotate it and review retained versions, exports and backups as well as the current page.
Keep the context. Move the work forward.
Connect your knowledge to the AI you already use. Find your starting point and make the next conversation count.