Trust & Compliance
Your data, protected by design
Engram is built on Cloudflare's global network with tenant isolation at every layer. We're in the process of formalizing our compliance program and welcome conversations with security-conscious buyers.
Last updated September 15, 2026
GDPR
CompliantWe honor data subject rights (access, correction, deletion, portability). Data Processing Agreement available at /dpa. EU data residency available on Enterprise.
CCPA / CPRA
CompliantWe do not sell personal information. California residents can exercise access and deletion rights via privacy@getengram.app.
Security by design
Security isn't a policy we bolted on — it's how the system works. For the full technical breakdown, see our security documentation.
Tenant isolation
Vectorize searches include organization metadata filters at the index level. Customer API keys are strictly tenant-scoped — every query filters on organization_id, and no customer credential can read or write another tenant's data. Internal operations (aggregate metrics, account management, support) run through a separate admin interface protected by its own secret, never reachable with customer credentials.
Encryption in transit and at rest
All traffic is served over TLS 1.3. Cloudflare D1 and Vectorize encrypt data at rest with AES-256. The .app TLD enforces HSTS preload, so browsers never connect in plaintext.
API key hygiene
API keys are displayed exactly once at creation and stored as SHA-256 hashes. Keys support expiration and instant revocation. Last-used timestamps are maintained for audit.
Automatic secret redaction
API keys, credentials, connection strings, JWTs, PEM private keys, and PII are automatically stripped from every message before storage. Secrets are replaced with [REDACTED]markers at ingest time — they never enter the database, the search index, or the embedding vectors. See the technical paper for details.
Content stays inside Cloudflare
Embeddings are generated on Cloudflare Workers AI (bge-base-en-v1.5). Your conversation content is notsent to OpenAI, Anthropic, Cohere, or any third-party embedding provider. The entire storage and search path stays within Cloudflare's network.
No training on your data
We do not use your stored conversations to train models — ours or anyone else's. We do not share your data with other customers. This is a contractual commitment, not an opt-out.
Deletion, on your terms
A memory you can't delete isn't yours. Every path below is self-serve, and “deleted” means destroyed — the rows, the search index entries, the vector embeddings, and the stored message bodies — not a hidden flag.
Delete a conversation, any time
From the dashboard or the delete_conversationtool. The deletion removes the conversation's content, its full-text index entries, its vector embeddings, and its verbatim message bodies from content storage — in that careful order, so a failure aborts loudly rather than half-deleting. Freed space returns to your storage quota immediately.
Delete your account in one click
Account deletion starts a 30-day recovery window — mistakes happen, and you can restore everything during it. When it lapses, an automated purge permanently erases your conversations, message bodies, embeddings, search index, metadata, usage records, email logs, API keys, and OAuth grants. If the purge cannot complete for any reason, it refuses to report success and retries — we never claim a deletion we did not perform.
Need it gone faster?
Ask, and we'll waive the recovery window: verified erasure requests are hard-deleted promptly — typically the same business day — with written confirmation of exactly what was removed. Encrypted infrastructure backups expire automatically within 30 days and are never restored into production.
Take everything with you first
Your full archive is exportable from the dashboard at any time, in machine-readable JSON — every conversation, every message, verbatim. Deletion is a right, not a trap door: you can leave with your data, not just without it.
Subprocessors
A minimal set of vendors that process your data on our behalf. Each vendor is bound by a data processing agreement and has been reviewed for security posture.
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Compute (Workers), database (D1), vector index (Vectorize), embeddings (Workers AI) | Conversation content, embeddings, API keys (hashed) | Global / US |
| Stripe | Payment processing, subscription management | Billing contact, payment method (stored by Stripe directly) | US |
| Supabase | Authentication (sign-in, sessions, password login) | Account email, credentials, session tokens | US |
| Vercel | Marketing site and documentation hosting | None — the app API runs on Cloudflare, not Vercel | US |
We'll notify Enterprise customers at least 30 days before adding a new subprocessor that processes customer data.
Data residency
By default, Engram uses Cloudflare's global placement for storage. Enterprise customers can request region-pinned storage (US, EU) at contract time. We do not currently offer single-tenant deployments.
Incident response
If we become aware of a security incident affecting your data, we will notify affected customers without undue delay and within the timeframes required by applicable law. Enterprise customers receive a written post-incident report.
Suspected a vulnerability? Email security@getengram.app. Please do not disclose publicly until we've had a chance to respond and remediate.
Security review?
If you're working through a security questionnaire or vendor assessment, or need a DPA, we're happy to help. Most requests are answered within two business days.
What we don't have yet, stated plainly: Engram is not SOC 2 certified, and we cannot sign a BAA — so Engram is not suitable for protected health information (PHI) under HIPAA. The infrastructure underneath us (Cloudflare, Supabase, Stripe, Vercel) is SOC 2 certified, but that is their attestation, not ours.