Security and privacy
A memory holds what people tell you, so who can read it, and how it is forgotten, matter as much as what it can do. This is how Geniffy handles both.
Where memory is stored
Geniffy stores memory in India. Every call to the API, the MCP server and the app travels over HTTPS.
Who can read a memory
- Your key reaches your memory, and nothing else. An API key reaches its owner's memory and the spaces beneath it, never another account's. Revoke a key in the Geniffy app and it stops working at once.
- Each of your users is separate. A space is one of your users. What is added to one space is never found from another, and your own memory never mixes with theirs.
- Keys stay on your server. A key is shown once, when you make it. Keep it out of browsers and mobile apps.
How AI apps are let in
Claude, ChatGPT, Cursor and the other apps connect through the MCP server with a sign-in, never with a copied key.
- You approve each app. Geniffy shows who is asking and where it will send you back, and nothing is shared until you choose Allow. You can allow reading only.
- Access is short-lived. An app's access lasts an hour and is renewed with a refresh token that works once. A refresh token used twice ends that app's access, because only a copied token would be used twice.
- Tokens are stored as hashes. Geniffy keeps a one-way hash of each app's tokens, not the tokens themselves.
- You can disconnect at any time, in the Geniffy app under Agents and MCP.
The details are in Sign-in.
Forgetting
- One memory, forgotten for good, or marked wrong with what is right saved in its place. See Correct and forget.
- One source, and every memory only it taught.
- Everything held for one of your users, with one call, when they ask to be forgotten.
A record of every call
Every call gets a request id, and a record of what was asked and what came back that you can search in the Geniffy app for 30 days. See Request ids.
Secrets
Don't add passwords, API keys or other secrets to a memory. The memory tools tell AI apps never to save them, and the Claude Code plugin removes them before anything leaves your computer.
Report a vulnerability
Email ops@geniffy.com with what you found and how to reproduce it, and please don't open a public issue. See the security policy.