Trust model

Agents propose.
Humans approve.

Everything Memkist automates is bounded by something a person controls. This page is the plain list of what the system enforces — and what it refuses to do.

Human
A real person approves anything that matters — your AI proposes, never decides alone
Isolated
Your files live in their own sealed space — no other company can reach in
Scoped
Your team only ever sees its own files — in search, in the assistant, in every AI tool
Metered
Every AI action is recorded and billed — no surprise usage behind your back
Boundaries

What the system refuses to do.

Boundaries only count when they hold under attack. Each of these is enforced in code and covered by adversarial checks that run against the live system — tests that try to cross the wall and must fail.

01

No cross-workspace reads

One storage bucket per workspace; tenant identity from the verified credential, re-checked every request; responses filtered by the asker's own permissions — never an escalation path.

02

No department leaks

Members search, read and ask only within their department — including through the assistant, digests, entity chips and the knowledge graph.

03

No unreviewed actions

The organizer proposes moves with evidence; a manager approves. Workflows run a reviewed declarative spec with a fixed verb vocabulary — validated before saving and again at activation.

04

No delete through AI

External AI clients get search and ingest only. There is no delete tool on the MCP server — that boundary is deliberate and permanent.

05

No unmetered model calls

One counting gate in front of the model. Classification, summaries, extraction, answers, compiles — each lands in the ledger with its purpose.

06

No silent history

Changes to people, files, links and settings append to a hash-chained audit log — verified on demand, exportable, and fork-proof under concurrent writes.

Questions

Asked and answered.

Who can see our files?
Only the people in the file's department, inside your workspace. Each workspace has its own storage bucket, tenant identity is re-checked against the database on every request, and every read surface — search, assistant, digests, the graph — re-checks the department wall before a byte moves.
Can an AI action delete or move files on its own?
No. Agents propose; humans approve. The organizer agent's move and relabel proposals require a manager's approval, external AI clients get read and ingest tools only — there is no delete tool — and workflows execute a fixed, reviewed verb vocabulary.
Can we verify what the AI did?
Yes. Every model call lands in a usage ledger tagged with its purpose. Automations write a run record for every firing. And the audit log is a hash chain per workspace — tampering with a record breaks the chain, which the console's verification detects.
Is our content used to train the model?
The platform runs one operator-configured model. Your prompts and documents are never exposed to other tenants — the assistant's memory and retrieval are scoped to your workspace and department.

Still deciding?

Run the simulator, read the architecture — then bring a real folder.

Try the simulator See the architecture