2:I[2567,["6137","static/chunks/6137-736c50599a943692.js","6797","static/chunks/6797-4dbe642c8fd0ae0a.js","946","static/chunks/946-e72d602ee78b2d72.js","2972","static/chunks/2972-ef0abf2c41a2d5d4.js","2567","static/chunks/2567-3326faa577cbc67f.js","2941","static/chunks/app/(marketing)/security/page-f12db43a6103ddc3.js"],"MarketingShell"]
3:I[7382,["6137","static/chunks/6137-736c50599a943692.js","6797","static/chunks/6797-4dbe642c8fd0ae0a.js","946","static/chunks/946-e72d602ee78b2d72.js","2972","static/chunks/2972-ef0abf2c41a2d5d4.js","2567","static/chunks/2567-3326faa577cbc67f.js","2941","static/chunks/app/(marketing)/security/page-f12db43a6103ddc3.js"],"Section"]
4:I[2972,["6137","static/chunks/6137-736c50599a943692.js","6797","static/chunks/6797-4dbe642c8fd0ae0a.js","946","static/chunks/946-e72d602ee78b2d72.js","2972","static/chunks/2972-ef0abf2c41a2d5d4.js","2567","static/chunks/2567-3326faa577cbc67f.js","2941","static/chunks/app/(marketing)/security/page-f12db43a6103ddc3.js"],""]
5:I[4707,[],""]
6:I[6423,[],""]
7:I[4873,["6137","static/chunks/6137-736c50599a943692.js","6797","static/chunks/6797-4dbe642c8fd0ae0a.js","946","static/chunks/946-e72d602ee78b2d72.js","16","static/chunks/16-0470043dee45584b.js","2972","static/chunks/2972-ef0abf2c41a2d5d4.js","5915","static/chunks/5915-ad0b336dee15b236.js","3185","static/chunks/app/layout-c2276ee34391fc30.js"],"Providers"]
8:I[6151,["6137","static/chunks/6137-736c50599a943692.js","6797","static/chunks/6797-4dbe642c8fd0ae0a.js","946","static/chunks/946-e72d602ee78b2d72.js","16","static/chunks/16-0470043dee45584b.js","2972","static/chunks/2972-ef0abf2c41a2d5d4.js","5915","static/chunks/5915-ad0b336dee15b236.js","3185","static/chunks/app/layout-c2276ee34391fc30.js"],"Shell"]
9:{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"}
a:{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"}
b:{"display":"inline-block"}
c:{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0}
0:["SukOXPARbdabeqthHy-f0",[[["",{"children":["(marketing)",{"children":["security",{"children":["__PAGE__",{}]}]}]},"$undefined","$undefined",true],["",{"children":["(marketing)",{"children":["security",{"children":["__PAGE__",{},[["$L1",["$","$L2",null,{"children":[["$","$L3",null,{"className":"pt-20 pb-14","children":[["$","div",null,{"className":"tech-label mb-4","children":"Security"}],["$","h1",null,{"className":"display max-w-xl text-[40px]","children":"What this actually protects, and what it does not."}],["$","p",null,{"className":"mt-5 max-w-lg text-[15px] leading-relaxed text-muted","children":"The moment an agent acts on a belief, someone is accountable for it. OMEM is built so you can reconstruct agent state at decision time. It is early software, it is free while in beta, and the second list on this page is as important as the first."}]]}],["$","$L3",null,{"className":"pb-16","children":[["$","div",null,{"className":"tech-label mb-4","children":"Implemented today"}],["$","div",null,{"className":"border-t","children":[["$","div","AUTHENTICATION",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"AUTHENTICATION"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Two modes, and the server picks neither for you. Local mode has no login and refuses to bind anything but loopback. Password mode (OMEM_AUTH=password) stores PBKDF2-SHA256 password hashes, and signup will not issue a session for an address that already has one."}]]}],["$","div","SECOND FACTOR",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"SECOND FACTOR"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"TOTP (RFC 6238), enforced at session creation and on claiming an account. Sessions expire after 30 days and can be revoked; expired and revoked tokens stop working immediately."}]]}],["$","div","TLS",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"TLS"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Set OMEM_TLS_CERT and OMEM_TLS_KEY and the server speaks HTTPS directly, TLS 1.2 floor. A terminating proxy is still the better answer at scale (it renews and resumes better than this does) but OMEM no longer requires one to avoid plaintext."}]]}],["$","div","ENCRYPTION AT REST",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"ENCRYPTION AT REST"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"OMEM_ENCRYPT_AT_REST encrypts memory content with AES-GCM: the operations log the engine is rebuilt from, ingested source payloads, and the quoted evidence behind each memory. Stored OAuth tokens are encrypted regardless. Lose the master key and you lose the data. There is no recovery path, by design."}]]}],["$","div","ACCESS CONTROL",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"ACCESS CONTROL"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Role-based, enforced per organization and per project. API keys are scoped to one project, carry their own role, can be bound to a single agent, and are revocable. Key secrets are shown once and stored hashed."}]]}],["$","div","TAMPER-EVIDENT AUDIT",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"TAMPER-EVIDENT AUDIT"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Every audit row commits to the one before it, per organization. Editing or deleting a row breaks every hash after it, and GET /v1/audit/verify says which row and why. Anchor the head hash somewhere OMEM does not control and the log becomes evidence rather than assertion."}]]}],["$","div","DATA RIGHTS",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"DATA RIGHTS"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"GDPR/CCPA export and erasure are endpoints, not a process: /v1/export/memories exports a project, and tenant erasure removes every project-scoped row. Backups taken before an erasure still contain the data until they age out."}]]}],["$","div","ABUSE CONTROL",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"ABUSE CONTROL"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Per-IP limits on the auth endpoints and per-tenant limits on data endpoints, keyed by project and credential so one key cannot starve another tenant."}]]}],["$","div","ONE WRITER",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"ONE WRITER"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"The engine is authoritative in memory, so a second process against the same database would answer the same question differently. The second process refuses to start and says so, rather than diverging quietly."}]]}],["$","div","DEPLOYMENT",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-accent","children":"DEPLOYMENT"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"Self-hosted, on SQLite or PostgreSQL. MIT licensed, so the engine that decides what your agents believe is one you can read, fork, and keep."}]]}]]}]]}],["$","$L3",null,{"className":"pb-16","children":[["$","div",null,{"className":"tech-label mb-4","children":"Not yet. Do not plan around these"}],["$","div",null,{"className":"border-t","children":[["$","div","Tamper-PROOFING",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"Tamper-PROOFING"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"The audit chain detects edits; it cannot prevent them. Anyone with write access can rewrite the chain from the edit forward. Detecting that requires keeping the head hash somewhere else, export it."}]]}],["$","div","SSO and SCIM",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"SSO and SCIM"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"No OIDC, SAML or SCIM. Accounts are email and password."}]]}],["$","div","Key rotation",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"Key rotation"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"There is one master key and no re-encryption tooling. Rotating it today means decrypting and re-encrypting by hand."}]]}],["$","div","Data residency",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"Data residency"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"No region pinning. Your data is wherever you run it."}]]}],["$","div","Certifications",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"Certifications"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"No SOC 2, ISO 27001 or HIPAA BAA. None are in progress."}]]}],["$","div","High availability",{"className":"spec-row border-b py-6","children":[["$","div",null,{"className":"text-xs font-medium text-conflict","children":"High availability"}],["$","p",null,{"className":"max-w-xl text-[14px] leading-relaxed text-muted","children":"One writer per database, enforced. That makes divergence impossible, not uptime possible: there is no second replica, no rolling deploy, and a restart replays the operations log before serving."}]]}]]}],["$","p",null,{"className":"mt-6 max-w-xl text-[13px] leading-relaxed text-muted","children":"If your deployment needs something on this list, OMEM is not ready for it yet. Saying so here is cheaper for both of us than saying so after an audit."}]]}],["$","$L3",null,{"className":"pb-8","children":["$","div",null,{"className":"spec-row border-t pt-12","children":[["$","div",null,{"className":"tech-label pt-1","children":"No lock-in"}],["$","div",null,{"children":[["$","h2",null,{"className":"display max-w-lg text-[28px]","children":"An open standard you can verify, and leave with."}],["$","p",null,{"className":"mt-5 max-w-lg text-[15px] leading-relaxed text-muted","children":"OMEM is a standard first, with a public conformance suite. \"Correct\" is decidable: every deployment passes the identical 29-vector CTS. An agent built against one OMEM behaves the same against another. Your memory's meaning never leaves with a vendor."}],["$","dl",null,{"className":"mt-8 max-w-md overflow-hidden rounded-lg border bg-panel text-[13px] shadow-sm","children":[["$","div","Protocol",{"className":"flex items-center justify-between border-b px-4 py-2.5 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Protocol"}],["$","dd",null,{"className":"num text-[13px]","children":"OMEM 1.0"}]]}],["$","div","Conformance",{"className":"flex items-center justify-between border-b px-4 py-2.5 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Conformance"}],["$","dd",null,{"className":"num text-[13px]","children":"CTS 29/29 / deterministic"}]]}],["$","div","Reference engine",{"className":"flex items-center justify-between border-b px-4 py-2.5 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Reference engine"}],["$","dd",null,{"className":"num text-[13px]","children":"open source, self-hostable"}]]}],["$","div","License",{"className":"flex items-center justify-between border-b px-4 py-2.5 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"License"}],["$","dd",null,{"className":"num text-[13px]","children":"MIT"}]]}],["$","div","Audit stream",{"className":"flex items-center justify-between border-b px-4 py-2.5 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Audit stream"}],["$","dd",null,{"className":"num text-[13px]","children":"append-only, exportable"}]]}]]}],["$","$L4",null,{"href":"/docs/quickstart","className":"link-underline mt-8 inline-block text-[13px]","children":"Read the quickstart"}]]}]]}]}]]}],null],null],null]},[null,["$","$L5",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children","security","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[null,["$","$L5",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":"404"}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]],null]},[[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/fdbeb859d29f54a9.css","precedence":"next","crossOrigin":"$undefined"}]],["$","html",null,{"lang":"en","suppressHydrationWarning":true,"children":["$","body",null,{"children":["$","$L7",null,{"children":["$","$L8",null,{"children":["$","$L5",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L6",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$9","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$a","children":"404"}],["$","div",null,{"style":"$b","children":["$","h2",null,{"style":"$c","children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]}]}]}]}]],null],null],["$Ld",null]]]]
d:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1"}],["$","meta","1",{"charSet":"utf-8"}],["$","title","2",{"children":"Security / OMEM"}],["$","meta","3",{"name":"description","content":"Give your AI memory it can prove."}]]
1:null
