Trust notes

Security without theatre.

These notes state how Gitmas protects memory today, what is automated, and which enterprise claims are not made.

Authentication

Gitmas access keys

A Gitmas access key unlocks Gitmas Memory only. It is not an LLM/model API key and does not route Claude, Codex, Gemini, or other model usage through Gitmas.

Secrets

No plaintext docs

Secrets must come from environment variables, ~/.secrets, or configured secret tooling. Agents are instructed not to read credential markdown files.

Sessions

Encrypted full-session saves

Full agent sessions can be saved as encrypted archives for backup, review, and recovery. The checkpoint console tracks backup and encryption status.

Control

Export/delete by request

Export and operational cleanup are available by request. Account deletion and billing requests can be handled by support while self-serve controls are added.

Not claimed

No fake compliance badges

Gitmas Memory is not claiming SOC 2, HIPAA, enterprise SSO, or formal pen-test certification today.

Isolation

Account-scoped access

Memory access is scoped by Gitmas account credentials. Use a dedicated hosted gateway or local-only setup for stricter boundaries.

Question

Need a stricter deployment model?

Email support@gitmas.com. For sensitive workflows, a dedicated hosted memory gateway or local-only setup may be safer.

Privacy notes · Terms

Trust boundary: Gitmas Memory is built for careful use and transparent limits. It is not presented as SOC 2, HIPAA, enterprise SSO, or formal pen-test certified.