Trust center
Security for agent-to-agent memory.
Dijin is designed so agents do not need to trust each other with private memory. Each agent connection is scoped, logged, evidence-backed, and revocable.
Cloud Intelligence: your consent boundary
One switch decides whether Dijin extracts memory from what you save. With it off, recall stays empty. With it on, extraction happens in flight and the plaintext is discarded once the job finishes.
Cloud Intelligence OFF
Memory intake only. Dijin can receive what you save, but it does not extract memory from selected source text until you turn this on. Recall may stay empty for unprocessed sources.
Cloud Intelligence ON
Chosen source text is processed in flight by Dijin’s worker to extract memory, then discarded. Derived claims sync to your account according to their lane.
Security for agent-to-agent memory
Dijin is designed so agents do not need to trust each other with private memory.
- a registered client identity
- scoped OAuth grants
- raw source disabled by default
- evidence returned only when authorized
- write access gated as proposals
- access logged in a tamper-evident chain
- one-click revocation
What Dijin prevents
Agent memory leakage
Agents do not pass memory directly to each other; they recall through Dijin under scopes.
Silent mutation
Agents can propose memory, but cannot silently rewrite it.
Unsupported claims
No evidence means no answer.
Scope confusion
Dijin distinguishes no evidence, policy withheld, and transport error.
Raw source overexposure
Raw source access is off by default and highest-trust.
Vendor lock-in
Memory exports through DMF.
Stale memory
Supersession, valid time, and conflict checks prevent outdated recall.
Overbroad agent permissions
OAuth scopes, revocation, and audit logs bound every connection.
Two lanes, never mixed
How a memory reaches Dijin decides what we can see, and we never blur the two.
Owner-Attested
Memory you save directly is owner-signed (DMF, Ed25519). You attest to it, and Dijin stores and recalls it. The owner-signed vault that makes this end-to-end is still in preparation.
Connector-Attested
Memory from a connected app (Teams, GitHub, Linear…) arrives through that app's own pipeline. We disclose every sub-processor along that path, and we never pretend a vendor didn't see it.
Live today
Each maps to shipped, source-verified code.
- Live
Encrypted in transit
Every sync runs over TLS 1.3. Nothing crosses the network in the clear.
- Live
Owner-signed, verifiable offline
Your memory is a DMF archive signed with your key (Ed25519). Any reader, whether that's Dijin or a third party, can verify it without trusting our servers.
- Live
Tamper-evident access log
Every claim and access is hash-chained and append-only. The chain is independently verifiable from any device.
- Live
Evidence, or "I don't know"
Every answer carries its source, valid time, and trust tier. When Dijin can't ground a claim, it refuses instead of guessing.
In preparation
We won't claim these until they ship. Today, stored data is plaintext at rest.
- In preparation
Encryption at rest
At-rest encryption of your synced memory is on the roadmap. Today we protect it in transit (TLS) only.
- In preparation
Owner-signed vault
A vault that binds your memory under a key derived on your own devices is in preparation. It makes the full custody chain provable offline.
- In preparation
Device-held keys
Keys that only ever live on your devices (so we genuinely can't read your content) arrive with the vault. We don't claim "your keys" until then.
How does it compare?
Six privacy properties measured against four widely-used products and Dijin. Every cell is verifiable; no marketing adjectives.
| How does it compare? | WhatsAppEncrypted messaging | iCloud (default)Default cloud posture | iCloud (Advanced Data Protection)Opt-in user keys | SignalEncrypted messaging | DijinMemory Layer |
|---|---|---|---|---|---|
End-to-end encrypted at rest by defaultStored content is unreadable by the provider, without any user opt-in step. | PartialBackups historically separate posture. | NoApple holds the keys for several data classes. | YesUser opt-in. | YesDefault posture for messages. | NoIn preparation, at-rest encryption and the owner-signed vault are on the roadmap (TLS in transit today). |
You hold the keysThe decryption material derives from a phrase only your devices ever see. | Partial | No | Yes | Yes | PartialPartial, your recovery phrase derives an owner key held on your device today; binding it to your synced cloud memory (the owner-signed vault) is in preparation. |
Open, portable export formatYou can take your data out and verify it offline with a publicly documented standard. | No | Partial | Partial | Partial | YesDMF, RFC-tracked, signed, conformance-vector tested. |
Server-side ML on metadataDoes the provider run machine-learning models over your metadata for ranking or recommendations? | Yes | Yes | Yes | Yes | NoNo metadata is fed to any third-party ML model for training. |
Independently verifiable chainA regulator, auditor, or you can re-derive the integrity of stored claims without trusting the runtime. | No | No | No | Partial | YesHash-chained audit log; `dijin verify` re-runs the chain offline. |
AI integrations preserve your evidence-bound memory contractWhen you connect Dijin (or your data) to an external AI, the encryption guarantees survive the handshake. | Not applicable | Not applicable | Not applicable | Not applicable | PartialMCP scopes are read-only by default; every grant is auditable; Lock B signed footer never strips. |
Verified properties as of 2026-05. Updated as vendor postures change.
Don't trust us. Verify.
Every claim is hash-chained. The chain is independently verifiable from any device.
Paste a signed DMF archive and check its Ed25519 signature in your browser. The Memory Kernel boundary (cite-or-refuse) is identical on Web, Tauri, iOS, and Android.
Eight scopes, least privilege by default
AI clients request only what they need. Two scopes carry extra gates.
memory.summary
Read high-level summaries only.
memory.decisions
Read confirmed decisions and their rationale.
memory.entities
Read people, projects, and things in your memory graph.
memory.evidence
Read the evidence pack behind an answer.
memory.conflicts
Read where claims disagree or were superseded.
memory.audit
Read the tamper-evident access log.
memory.raw_source.read 🔒
Read raw source text. Highest-trust scope. Pro-gated, device-confirmed, and never granted by default.
memory.write 🔒
memory.write proposes memory, corrections, or links. It never silently mutates the graph; proposals pass through the worker, policy checks, and review gates.
Subprocessors
External services we use to operate Dijin, and what they see. Add/remove changes are reflected here and announced via DPA notification when material.
Supabase (Stockholm)
Authenticated kg.* rows (claims, entities, evidence, audit_logs) under per-user RLS. Operates the Postgres + Edge Functions substrate.
Cloudflare R2
Owner-signed encrypted DMF archives (vault canonical) + audit snapshots. Object content is ciphertext; bucket metadata is operational.
Vercel
Web app hosting + serverless function execution. Request logs (URL, method, status, latency) for operability; no request body content is retained.
Google Gemini (embeddings)
Query text and derived claim text, sent to produce vector embeddings for recall ranking. Not raw transcript plaintext.
Anthropic Claude (extraction + Memory Kernel composer)
Two Cloud Intelligence ON paths: (1) extraction — raw segment plaintext ephemerally during one extraction job, to derive entities and claims (held only for the job, discarded after); (2) answer-time — an EvidencePack (already-derived claims + their citations) plus the user's query text, to compose grounded answers under the composer-only policy (Memory Kernel S3); the LLM never authors a fact, only cites the pack.
Paddle (web billing)
Web subscription transactions (Pro annual, Plus annual). Acts as Merchant of Record; sees billing identity + card details (Dijin does not). Plus on iOS/iPadOS/macOS is billed by Apple App Store, not Paddle.
Cloudflare Turnstile
Sign-up / sign-in challenge tokens. Bot-mitigation challenge result only; no Dijin content crosses.
What a legal request can reach
We tell you the truth about today, not the marketing of tomorrow.
Today (plaintext at rest)
Because at-rest encryption isn't shipped yet, a valid legal order could compel the memory you've synced, your account records, and access logs. We don't pretend otherwise.
With the vault (in preparation)
Once the owner-signed vault ships, your content becomes unreadable to us. A request could reach only ciphertext, timestamps, and account records. We'll update this page the day that's true, not before.
Security Contact
We take security seriously. If you have a concern about the security of our product, we welcome your input:
contact@dijin.co