If you're choosing between a local and a hosted agent memory, you've probably read the same sentence on four different sites: nothing of your data ever leaves your machine. It's a slogan, not a data-flow description, and it can't be tested — so you can't compare vendors on it. You're left guessing.
We know exactly how useless that sentence is, because we wrote it. Our own marketing used to say "nothing of your memory ever leaves your machine." Then our architecture changed: the hub became the brain, and pieces of memory started travelling to it to be worked on. "Never leaves" stopped being true. We retired the line and replaced it with a precise one. The "never leaves" claim died. The storage claim survived, because it was still true: your memory is stored in exactly one place, the one you chose at signup: your own machine, or our servers in Germany, encrypted under a key only you hold.
That amendment is why this article can be precise. We have already caught ourselves making the vague version and paid the price of correcting it. Here is the exact data flow for both editions — what rests, what moves, and what is kept at the far end.
The distinction that makes the answer precise: storage vs processing
Two questions hide inside every privacy claim, and vendors blur them into one:
- Storage — where memory rests when nothing is happening. Where the bytes persist while you sleep, where backups live, who holds the key.
- Processing — where a piece of memory goes to be worked on, transiently. A brief composed, a record judged, a search answered.
"Nothing ever leaves" is a processing claim. And almost every agent memory system has a processing step — memory that is never read anywhere is memory that never gets curated, briefed, or matched to a prompt. So an absolute processing claim is nearly always false, or becomes false at the next release. The honest claim is about what is kept, not what moves.
That gives you a test you can apply to any vendor, including us:
- Where does memory rest when nothing is happening, and who holds the key?
- What travels during processing, how often, and to where?
- What does the processing side retain after the work is done — durably, in backups, in logs?
- Is the processing optional? Can I turn it off?
- Can I verify all of this without trusting you?
Ask those five and every slogan collapses into an answerable question. Here are our answers.
Local edition: the byte-by-byte map
What rests on your machine, and nowhere else. The entire memory: the curated records, the full chat archive, the graph of decisions, the notes, the playbooks, and the search over all of it. It lives in a container on your disk — Docker or Podman, roughly 3 GB including the memory model. Your storage, your disk, no cap from us. The container holds the memory and the search; it holds no model access and no setting that points anything at a model.
What crosses the wire, and why. Every exchange passes through our hub — that is how memory gets made; something has to read the conversation to curate it. Beyond that, only the piece under judgement travels: a window of exchanges when it's time to curate, a search request and its answer when recall needs composing, a session's opening context when the brief is built. The hub is the reader, not the shelf.
What the hub keeps. Nothing that passes through. Each piece stays only long enough to be understood, and is kept by nobody. The hub holds exactly two durable things: your standing rules, and one line per project saying what the project is. That is the whole inventory.
Where processing physically runs. The hub is a secure compute instance in Zurich, Switzerland, in a Tier III+ datacenter — redundant power, generator backup, the tier as the vendor states it in its own security documentation. The model that does the reading is under a zero-data-retention contract: the provider is bound not to log, retain, or train on what passes through. That is their commitment, disclosed on our legal pages — we state it as theirs, not as our guarantee. The yes-or-no checks (has a conversation overturned a record; which earlier decision lines does it bear on) run on a second, decision-only model that writes no text, listed by its host as zero data retention. No vendor names here; the legal pages carry the sub-processors.
So the local answer in one line: storage never leaves your machine; processing passes through ours and is kept by nobody. Anything shorter than that — including our own old sentence — is hiding something.
Hosted edition: the same rule, one location different
The hosted edition is the same pipeline with one difference: the container sits on our VPS instead of your machine.
Storage. Your whole memory is encrypted under a key derived from a passphrase that only you set and only you hold. It unlocks when you start a session and locks itself after an idle window you choose. While locked, it is ciphertext to everyone — including us. Forget the passphrase and nobody can open it; the memory is gone, and no support ticket changes that. The encrypted memory sits in Germany. Backups are the encrypted memory itself, in Germany, on a short cycle, deleted when your account is.
Processing. Identical to local. Your box sends the hub the same pieces — windows of exchanges for curation, search asks, brief requests — the hub processes them, and keeps none of them. Same Zurich compute, same zero-retention model, same two durable items on the hub (your rules, your project lines).
The honest summary for a comparison table: hosted adds exactly one exposure beyond local — our hosting of your resting memory, encrypted under your key. Nothing more. The processing pass is the same transient trip for every customer on either edition.
How to check this yourself
We could ask you to believe the map above. Better: read the client and check it.
The client is source-available — you can read every line and see exactly what leaves your machine: exchanges go up, the processing asks and search answers go up, commands and result rows come down. Install it pinned to a tag from the GitHub repo and diff the versions if you want. This is not "open source" in the loose way people say it; it is the license we publish under, and the point of it is precisely this audit.
Now the stop-list honesty — the things we don't claim, because they stopped being true or were never true:
- We do not claim "we cannot read your memory." We used to, when the architecture was different; when it changed, we retired the line in public. What survives is the storage claim and the "kept by nobody" claim.
- There is no consent switch and no air-gapped mode. Every reading of the memory that makes it a brain is our hub's, for every customer. If a vendor offers you an absolute claim, ask what their fallback is when the architecture changes. Ours is this article.
- We do not claim the model processing stays in Europe.
And what happens if our hub is unreachable: the memory on your box keeps recording, and your agent's own search tools keep working; only the brief, the per-prompt recall, and the tidying wait until the hub is back. Nothing is lost. Full legal detail — sub-processors, retention, the model's hosting regions — lives on our privacy, terms, and security pages, where it is stated precisely rather than as a slogan.
Which edition is yours
The data flow is the same in both editions. The difference is one thing: where the memory rests.
Local, if the resting memory must be on your own disk — your storage, your machine, unlimited by us — and you accept running a container. Hosted, if you want no server to run, and you accept encrypted-at-rest storage in Germany under a passphrase only you hold.
One hard fact before you choose: the edition is picked at signup, and switching later is not offered. Decide on the data flow, not on price.
And one thing both editions share, stated plainly rather than buried: every customer's exchanges and judgement pieces pass through our hub for transient processing, on both editions, with no mode to turn it off. That is not a caveat we'd hide — it is the mechanism that makes a memory be a memory, and the honest version of every "nothing ever leaves" claim ever printed.
The five questions above are your takeaway. Ask them of any vendor — and if their answers can't fit in a paragraph like the ones above, that paragraph is the one they didn't want to write.
The receipts for our own answers, kept current, are at brethof.ai/brain/security/. If they hold up for you, start at brethof.ai/brain/: the free plan is 500 messages a month, no card.
If you end up writing about it yourself, we run an affiliate programme — details at brethof.ai/brain/affiliate/.
Top comments (0)