2:I[2567,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","4873","static/chunks/4873-d3832094381cdad1.js","2567","static/chunks/2567-5a770fb5c2fddd8c.js","2941","static/chunks/app/(marketing)/security/page-44f0b2491b2c6377.js"],"MarketingShell"]
3:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","4873","static/chunks/4873-d3832094381cdad1.js","2567","static/chunks/2567-5a770fb5c2fddd8c.js","2941","static/chunks/app/(marketing)/security/page-44f0b2491b2c6377.js"],"Section"]
4:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","4873","static/chunks/4873-d3832094381cdad1.js","2567","static/chunks/2567-5a770fb5c2fddd8c.js","2941","static/chunks/app/(marketing)/security/page-44f0b2491b2c6377.js"],"PageHeader"]
5:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","4873","static/chunks/4873-d3832094381cdad1.js","2567","static/chunks/2567-5a770fb5c2fddd8c.js","2941","static/chunks/app/(marketing)/security/page-44f0b2491b2c6377.js"],"SpecList"]
6:I[7382,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","4873","static/chunks/4873-d3832094381cdad1.js","2567","static/chunks/2567-5a770fb5c2fddd8c.js","2941","static/chunks/app/(marketing)/security/page-44f0b2491b2c6377.js"],"ButtonLink"]
7:I[4707,[],""]
8:I[6423,[],""]
9:I[4873,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","1713","static/chunks/1713-a64ba0d5e6aae143.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","3975","static/chunks/3975-52ed6f58eef56249.js","4873","static/chunks/4873-d3832094381cdad1.js","3185","static/chunks/app/layout-d075ade29984b3e7.js"],"Providers"]
a:I[6151,["8905","static/chunks/8905-f6f9469353911fb0.js","3143","static/chunks/3143-242beb2943338ff8.js","7864","static/chunks/7864-df8ea73c5cbe0896.js","1713","static/chunks/1713-a64ba0d5e6aae143.js","7648","static/chunks/7648-34771bb3fdb1b05c.js","3975","static/chunks/3975-52ed6f58eef56249.js","4873","static/chunks/4873-d3832094381cdad1.js","3185","static/chunks/app/layout-d075ade29984b3e7.js"],"Shell"]
b:{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"}
c:{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"}
d:{"display":"inline-block"}
e:{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0}
0:["BA5AAYKS2Dj4gA0JSXby2",[[["",{"children":["(marketing)",{"children":["security",{"children":["__PAGE__",{}]}]}]},"$undefined","$undefined",true],["",{"children":["(marketing)",{"children":["security",{"children":["__PAGE__",{},[["$L1",["$","$L2",null,{"children":[["$","$L3",null,{"className":"page-y","children":["$","$L4",null,{"eyebrow":"Security","title":"What this actually protects, and what it does not.","children":"The moment an agent acts on a belief, someone is accountable for it. OMEM is built so you can reconstruct agent state at decision time. It is early software, it is free while in beta, and the second list on this page is as important as the first."}]}],["$","$L3",null,{"className":"pb-20 sm:pb-28","children":[["$","div",null,{"className":"flex items-baseline gap-3","children":[["$","span",null,{"className":"led believed shrink-0","aria-hidden":"true"}],["$","h2",null,{"className":"display text-xl","children":"Implemented today"}]]}],["$","p",null,{"className":"mt-3 max-w-read text-body text-muted","children":"Each of these exists in the repository and is covered by the test suite."}],["$","div",null,{"className":"mt-8","children":["$","$L5",null,{"items":[{"k":"Authentication","d":"Two modes, and the server picks neither for you. Local mode has no login and refuses to bind anything but loopback. Password mode (OMEM_AUTH=password) stores PBKDF2-SHA256 password hashes, and signup will not issue a session for an address that already has one."},{"k":"Second factor","d":"TOTP (RFC 6238), enforced at session creation and on claiming an account. Sessions expire after 30 days and can be revoked; expired and revoked tokens stop working immediately."},{"k":"TLS","d":"Set OMEM_TLS_CERT and OMEM_TLS_KEY and the server speaks HTTPS directly, TLS 1.2 floor. A terminating proxy is still the better answer at scale (it renews and resumes better than this does) but OMEM no longer requires one to avoid plaintext."},{"k":"Encryption at rest","d":"OMEM_ENCRYPT_AT_REST encrypts memory content with AES-GCM: the operations log the engine is rebuilt from, ingested source payloads, and the quoted evidence behind each memory. Stored OAuth tokens are encrypted regardless. Lose the master key and you lose the data. There is no recovery path, by design."},{"k":"Access control","d":"Role-based, enforced per organization and per project. API keys are scoped to one project, carry their own role, can be bound to a single agent, and are revocable. Key secrets are shown once and stored hashed."},{"k":"Tamper-evident audit","d":"Every audit row commits to the one before it, per organization. Editing or deleting a row breaks every hash after it, and GET /v1/audit/verify says which row and why. Anchor the head hash somewhere OMEM does not control and the log becomes evidence rather than assertion."},{"k":"Data rights","d":"GDPR/CCPA export and erasure are endpoints, not a process: /v1/export/memories exports a project, and tenant erasure removes every project-scoped row. Backups taken before an erasure still contain the data until they age out."},{"k":"Abuse control","d":"Per-IP limits on the auth endpoints and per-tenant limits on data endpoints, keyed by project and credential so one key cannot starve another tenant."},{"k":"One writer","d":"The engine is authoritative in memory, so a second process against the same database would answer the same question differently. The second process refuses to start and says so, rather than diverging quietly."},{"k":"Deployment","d":"Self-hosted, on SQLite or PostgreSQL. MIT licensed, so the engine that decides what your agents believe is one you can read, fork, and keep."}]}]}]]}],["$","$L3",null,{"className":"pb-20 sm:pb-28","children":["$","div",null,{"className":"rounded-lg border border-[color:var(--conflict)]/35 bg-conflictBg p-6 sm:p-8","children":[["$","div",null,{"className":"flex items-baseline gap-3","children":[["$","span",null,{"className":"led conflict shrink-0","aria-hidden":"true"}],["$","h2",null,{"className":"display text-xl text-conflict","children":"Not built yet — do not plan around these"}]]}],["$","p",null,{"className":"mt-3 max-w-read text-body text-muted","children":"If your deployment needs something on this list, OMEM is not ready for it. Saying so here is cheaper for both of us than saying so after an audit."}],["$","div",null,{"className":"mt-8","children":["$","$L5",null,{"items":[{"k":"Tamper-proofing","d":"The audit chain detects edits; it cannot prevent them. Anyone with write access can rewrite the chain from the edit forward. Detecting that requires keeping the head hash somewhere else — export it."},{"k":"SSO and SCIM","d":"No OIDC, SAML or SCIM. Accounts are email and password."},{"k":"Key rotation","d":"There is one master key and no re-encryption tooling. Rotating it today means decrypting and re-encrypting by hand."},{"k":"Data residency","d":"No region pinning. Your data is wherever you run it."},{"k":"Certifications","d":"No SOC 2, ISO 27001 or HIPAA BAA. None are in progress."},{"k":"High availability","d":"One writer per database, enforced. That makes divergence impossible, not uptime possible: there is no second replica, no rolling deploy, and a restart replays the operations log before serving."}],"tone":"conflict"}]}]]}]}],["$","$L3",null,{"className":"pb-24 sm:pb-32","children":["$","div",null,{"className":"grid gap-10 border-t pt-12 lg:grid-cols-[minmax(0,1fr)_minmax(0,380px)] lg:gap-14","children":[["$","div",null,{"children":[["$","h2",null,{"className":"tech-label mb-3","children":"No lock-in"}],["$","h3",null,{"className":"display max-w-2xl text-xl","children":"An open standard you can verify, and leave with."}],["$","p",null,{"className":"lede mt-4","children":"OMEM is a standard first, with a public conformance suite. “Correct” is decidable: every deployment passes the identical 29-vector CTS. An agent built against one OMEM behaves the same against another. Your memory’s meaning never leaves with a vendor."}],["$","$L6",null,{"href":"/docs/quickstart","variant":"quiet","className":"mt-5","children":"Read the quickstart"}]]}],["$","dl",null,{"className":"panel overflow-hidden text-note","children":[["$","div","Protocol",{"className":"flex items-center justify-between gap-4 border-b px-4 py-3 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Protocol"}],["$","dd",null,{"className":"mono text-right","children":"OMEM 1.0"}]]}],["$","div","Reference engine",{"className":"flex items-center justify-between gap-4 border-b px-4 py-3 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Reference engine"}],["$","dd",null,{"className":"mono text-right","children":"omem_engine 1.0.0, frozen and hash-checked"}]]}],["$","div","Independent conformance",{"className":"flex items-center justify-between gap-4 border-b px-4 py-3 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Independent conformance"}],["$","dd",null,{"className":"mono text-right","children":"None — the normative suite is not public"}]]}],["$","div","License",{"className":"flex items-center justify-between gap-4 border-b px-4 py-3 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"License"}],["$","dd",null,{"className":"mono text-right","children":"MIT, open source and self-hostable"}]]}],["$","div","Audit stream",{"className":"flex items-center justify-between gap-4 border-b px-4 py-3 last:border-b-0","children":[["$","dt",null,{"className":"text-muted","children":"Audit stream"}],["$","dd",null,{"className":"mono text-right","children":"Append-only, exportable"}]]}]]}]]}]}]]}],null],null],null]},[null,["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children","security","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[null,["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children","(marketing)","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":"404"}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]],null]},[[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/76ac85dcdfd12e8b.css","precedence":"next","crossOrigin":"$undefined"}]],["$","html",null,{"lang":"en","className":"__variable_f367f3 __variable_a3c0d3 __variable_3c557b","suppressHydrationWarning":true,"children":[["$","head",null,{"children":["$","script",null,{"dangerouslySetInnerHTML":{"__html":"(function(){try{\nvar s=localStorage.getItem(\"omem-theme\");\nvar d=s?s===\"dark\":window.matchMedia(\"(prefers-color-scheme: dark)\").matches;\nif(d)document.documentElement.classList.add(\"dark\");\ndocument.documentElement.style.colorScheme=d?\"dark\":\"light\";\n}catch(e){}})();"}}]}],["$","body",null,{"children":[["$","a",null,{"href":"#main","className":"skip-link","children":"Skip to content"}],["$","$L9",null,{"children":["$","$La",null,{"children":["$","$L7",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":"$b","children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":"$c","children":"404"}],["$","div",null,{"style":"$d","children":["$","h2",null,{"style":"$e","children":"This page could not be found."}]}]]}]}]],"notFoundStyles":[]}]}]}]]}]]}]],null],null],["$Lf",null]]]]
f:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1, viewport-fit=cover"}],["$","meta","1",{"name":"theme-color","media":"(prefers-color-scheme: light)","content":"#faf9f6"}],["$","meta","2",{"name":"theme-color","media":"(prefers-color-scheme: dark)","content":"#171614"}],["$","meta","3",{"charSet":"utf-8"}],["$","title","4",{"children":"Security / OMEM"}],["$","meta","5",{"name":"description","content":"What OMEM protects today and what it does not. Implemented controls, and the list of things that are not built yet."}],["$","meta","6",{"name":"application-name","content":"OMEM"}],["$","meta","7",{"name":"format-detection","content":"telephone=no"}],["$","meta","8",{"name":"next-size-adjust"}]]
1:null
