Security by design, not by marketing

Physical infrastructure

• Postgres 17 + pgvector: Hetzner Online (Falkenstein, Germany), dedicated server with no public exposure
• Redis (BullMQ queues): same data center, private internal connection
• Worker processes: orchestration with healthchecks, automatic restart
• Object storage: Cloudflare R2, encrypted at rest

Encryption

• In transit: TLS 1.2 minimum, TLS 1.3 preferred (HTTPS/HSTS) for web and APIs
• At rest: the original files you upload (Cloudflare R2) are encrypted at rest. The database and its backups live on a dedicated, access-restricted server without disk encryption: their contents are protected by network isolation and access control rather than by cryptography

Authentication and authorization

• Auth: self-hosted Keycloak, dedicated realm for Memchats
• Sessions: NextAuth v5, JWT with rotatable secret, HttpOnly + Secure + SameSite=Lax cookies
• Social OAuth: federation with Google (Apple, Microsoft coming soon) managed via Keycloak
• API tokens: the mobile app uses Bearer tokens validated against the realm's JWKS

Subprocessors

Third-party services that process data on our behalf, all in the EU or with a signed SCC:

• Hetzner Online (Germany): hosting, compute infrastructure
• Cloudflare R2: object storage for original ingested files
• Cloudflare DNS: domain resolution, plus edge caching of the public site's static assets (not the app, and never message content)
• Google (Gemini, SCC + DPA signed): the language model that writes the answers, through Google AI or Vertex AI. Google does NOT train on data sent through the API
• Stripe (Ireland + USA, SCC signed): payment processing. Memchats does not store card data
• Sentry (USA, SCC signed): error tracking. Configured to send no PII or message content in breadcrumbs
• Self-hosted Mailcow (Hetzner Germany): transactional and catch-all email

Anonymization of third-party data

When you import a chat with María (who did not sign a consent form), Memchats:

• The contact shows up under the name you give them, not their phone number or email
• Their data stays under your account, is never shared with other accounts and is never used to train models
• If María requests deletion via dpo@memchats.com, we process it within 30 days

Privacy in LLM calls

When Memchats calls the model (Google's Gemini) to generate an advisor's response:

• Only the necessary context is sent (relevant structured memory + the last N messages)
• Google does not train on data sent through the API, and there is a signed no-retention contract

Access and operations

• Production access restricted to the founder via Tailscale + key-based SSH authentication
• Operational access restricted to the founder; we do not read your message content unless you ask us to in order to resolve an issue
• Operational logs contain no message content

Disclosure and bug bounty

If you find a vulnerability, write to us at security@memchats.com. We respond within 48h. Informal bug bounty (€50-€1000 depending on severity) for real vulnerabilities. Please do not test on other users' accounts; use your own account or create a test one.

Certifications

• GDPR: compliance by design, privacy contact at dpo@memchats.com
• SOC 2 Type II: planned for 2027 (once we have compliance budget)
• ISO 27001: roadmap 2027-2028 if enterprise validation requires it

Service status

There is no automated status page yet. Scheduled maintenance and any incident affecting the service are announced here and by email to the accounts involved. If something is down and nothing has been announced, write to hola@memchats.com.

Last audit

First external audit pending (planned for Q4 2026 with a specialized EU law firm). In the meantime, write to dpo@memchats.com and we will walk you through how it works inside.