Skip to content

Privacy & Security Reference

Your memory is yours. This page explains exactly how PowerMemory protects it — and, just as importantly, what that protection does and does not mean. No overclaiming.

Encryption at rest

Your vault is stored in a database encrypted with SQLCipher (AES-256).

  • The database file on disk is encrypted. If someone obtained the raw file, they could not read your memories without the key.
  • This protects against disk theft, stolen backups, and unauthorized file access at the storage layer.

What encryption at rest does not mean

Encryption at rest protects the data on disk. It is not end-to-end, zero-knowledge encryption. To serve your memories to your AI tools, the service decrypts them in memory for your authenticated requests. See What PowerMemory can and cannot see for the honest picture.

Authentication

Access to your vault is gated by OAuth 2.1 with PKCE (Proof Key for Code Exchange).

  • You sign in through a standard authorization flow — no password is shared with third-party clients.
  • Sessions use rotating refresh tokens, so a leaked short-lived token has limited value.
Advanced: the PKCE flow

PKCE protects the authorization code exchange against interception. The client generates a random code_verifier, derives a code_challenge (SHA-256), and sends the challenge with the authorization request. On token exchange, the original verifier is presented and validated server-side. This prevents an intercepted authorization code from being redeemed by an attacker who lacks the verifier — important for browser-extension and native clients that can't keep a traditional client secret.

Two-factor authentication (2FA)

2FA is optional and adds a second factor to your web login. When enabled, signing in requires a 6-digit code from your authenticator app (TOTP) in addition to your magic link — so access to your email alone is not enough to reach your vault through the website.

  • Enroll one or more authenticator apps (Google Authenticator, 1Password, etc.) — you can register several devices.
  • One-time backup codes are issued at setup, for when you don't have your authenticator on hand.
  • Your TOTP secret is encrypted at rest (AES-256-GCM) and backup codes are stored only as keyed hashes (HMAC) — never in plaintext.

What 2FA covers — and what it does not

2FA protects the website login only. It does not gate your API keys or MCP/OAuth connectors — those are an independent channel, secured by their own tokens that you can revoke at any time (Disconnect a single connector, or Kill connectors to revoke them all from the dashboard). Enabling 2FA does not retroactively re-protect tokens already issued to your AI tools, so treat your connector tokens as their own credential and revoke any you don't recognize.

There is no recovery without your codes

If you lose both your authenticator and your backup codes, your account — and the vault behind it — may be permanently unrecoverable. Support cannot bypass 2FA or verify your identity to restore access. Keep your backup codes somewhere safe, and consider enrolling a second device.

How the browser extension stores tokens

The Chrome extension never stores your credentials in plaintext.

  • Access and refresh tokens are encrypted locally using the browser's Web Crypto API (AES-GCM) before being written to extension storage.
  • Tokens are scoped and short-lived; the extension refreshes them as needed through the authenticated flow.

What PowerMemory can and cannot see

Being transparent matters more than sounding bulletproof.

What we do:

  • Store your vault encrypted at rest (SQLCipher AES-256).
  • Decrypt your memories in memory to serve them to your authenticated AI tools when you inject or read context.
  • Serve content only through your authenticated account.

What we don't do:

  • We do not sell your data.
  • We do not share your data with advertisers.
  • We do not show ads.
  • We do not use your private vault content to train models.

Honest threat model

PowerMemory is not zero-knowledge end-to-end encrypted. Because the service decrypts your memories to serve them back to your AI tools, the operator's infrastructure can technically access decrypted content while serving your requests. If your requirement is provider-blind, end-to-end encryption where no one but you can ever decrypt, PowerMemory does not currently claim that. What it does claim: encryption at rest, authenticated access, no selling, no sharing, no ad targeting, no training on your content.

Your data controls

You stay in control of your vault.

  • Export your memories anytime as JSON or Markdown from the dashboard.
  • Delete individual memories or your entire vault.
  • Review what's saved — your AI proposes memories, but you control what's kept.

Transport & network security

Traffic and headers are hardened at the edge.

  • HTTPS everywhere, with HSTS (strict transport security) enforced.
  • A strict Content-Security-Policy limits where scripts, styles, and resources can load from.
  • Standard protections: X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy, and a restrictive Permissions-Policy.
  • Abuse protection on sign-in flows (bot/spam mitigation).
Advanced: token lifecycle

Access tokens are short-lived; refresh tokens rotate on use. A used refresh token is invalidated when a new one is issued, so replay of an old refresh token fails. Sign-out and vault deletion invalidate active sessions. This limits the blast radius of any single leaked token.

Questions

If you have a specific privacy or security question not covered here, reach out via the Contact page.