Your memory needs clear boundaries.

Records are encrypted on your device.

Source records are encrypted client side before they are written to your vault, rather than sitting there as readable documents.

Your device creates and holds the vault key.

A new device needs both an emailed sign-in code and the recovery key you saved.

Access to the email account alone does not open the vault.

Inference receives your question and the authorised source text.

On a query, your question and the source text authorised for that Space go to a private inference endpoint.

So we do not claim that document content never crosses that boundary. It does.

The query path uses open-source models.

Calculations run on inspectable derivation logic where it is supported, and written summaries stay constrained by exact source quotations.

Cited quotations are checked against their sources.

The challenge step confirms that a displayed quotation exists in the source it cites.

It does not validate an accounting, legal, medical or regulatory conclusion.

Missing evidence stays missing.

If the authorised record cannot support an answer, you get an insufficient-evidence result instead of an invented bridge across the gap.