What guards your memory.
Becki is a private memory vault under your own account. This page documents the controls that protect it, as they actually run in production.
ODSR: secrets are redacted before storage
ODSR (On-Device Secret Redaction) is the credential screen. Every write to the vault passes it before storage and before embedding. Secrets are redacted in place and replaced with a typed marker, kind plus last four, so the surrounding memory stays and the secret does not.
What it redacts: API keys and secrets from all major providers (Anthropic, OpenAI/Codex, Stripe, AWS, GitHub, Slack, Supabase, Fly.io), plus JWTs, private keys, labeled Social Security numbers, and payment-card numbers (Luhn-checked so ids and timestamps do not false-positive). Unknown-shape high-entropy tokens are flagged, not redacted. That is not 100% coverage of novel formats.
The screen runs in two places that must never disagree: the TypeScript ingestion path and a PL/pgSQL twin inside the database itself, covering writes that reach tables directly. A release gate verifies the two stay byte-identical over a shared fixture set on every ship, and the release aborts if they drift. Redaction does not depend on which door the data came through.
ODIT: names are tokenized, not guessed
ODIT (On-Device Identity Tokenization) is the identity guardrail. It covers names (employee or client), worker IDs, and exact compensation. The server does not scan text for those. On an account with the gate enabled, ingest that lacks the paved-path tokenized marker is sealed into a quarantine table that has no embedding column, by design, with a guard that raises if one is ever added. That content is never sent to a subprocessor. It is not dropped. The device that holds the matching key can open its own sealed rows. Approve or reject a device from your signed-in account page. The banner there never turns the gate on by itself.
Gate on means every unmarked write quarantines until the client stamps the marker. Accounts without the gate stay on ODSR only. Hosted connections seal and queue; they are not the tokenizer.
One vault per user, isolated by the database
Your vault rows are keyed to your account and protected by PostgreSQL row-level security. Isolation is enforced by the database engine on every query, not by application code remembering to filter. Another user cannot read your rows, and a bug in an application layer above the database does not change that.
User-scoped database functions are not executable by client roles. Clients reach them only through an authenticated proxy that binds every call to the identity of the token that made it.
Team features share nothing by default. Sharing a memory into a team brain is an explicit act with its own membership checks, and anything marked confidential never routes to a team surface at all.
Tokens are scoped, expiring, and revocable
No Becki client holds a master credential. Each surface gets the narrowest token that does its job:
Install tokens authorize a single machine's ingest path, are stored as SHA-256 hashes server-side (Becki keeps no copy of the raw value), expire after 90 days with sliding renewal, and are revocable with one click from your account page. Rotating a token kills the previous one instantly.
OAuth access tokens for hosted connections expire after roughly one hour and renew through refresh tokens. Sign-in happens in your browser against your own account; Becki clients never see your password.
On your Mac, credentials live in the device-only Keychain, never in preference files and never synced.
Untrusted content stays data
When vault content is supplied to an AI model, it is fenced and labeled as untrusted data. Instructions that appear inside stored content are not treated as commands to the model reading them. This is Becki's standing defense against prompt injection through the vault.
What Becki never stores
Passwords, API keys, tokens, and private keys: redacted by the screen above, on every path. Becki also keeps no copy of raw install tokens (hashes only) and no plaintext of your OAuth credentials.
Your vault is yours. Becki staff do not read vault content, and there is no cross-tenant analytics on it. Deleting a memory removes it from retrieval; revoking a device cuts its access at the next request.
Verification
Every release runs a security preflight that scans for forged service-role authentication patterns in edge functions, user-scoped functions exposed to client roles, hardcoded secrets in source, unpinned function authentication, and drift between the two redaction implementations. A HIGH finding aborts the ship.
Questions, or something you think we missed? security@becki.io.