Security

Found a problem? Tell us

Email venturesgodspeed@gmail.com with “knowsme security” in the subject. Say what you found, how to see it happen, and what someone could do with it. A few lines is enough.

• We reply within 3 days to say we have it, and keep you told until it is fixed.
• We fix serious problems first, before anything else we are working on.
• We will not take legal action against anyone who looks for problems in good faith and follows the rules below.
• We credit you when it is fixed, if you want to be named.

The rules for testing

• Use your own account. Never read, change or delete anyone else’s memory, even to prove a point. If you reach someone else’s data by accident, stop and tell us.
• No denial-of-service, no flooding sign-up or email, no spam.
• No social engineering and no physical attacks.
• Give us a fair chance to fix it before you tell anyone else.

In scope: knowsme.dev, mcp.knowsme.dev, the setup and uninstall scripts at knowsme.dev/get/, and the older addresses that serve the same thing.

Who else handles your data

These companies run parts of knowsme for us. None of them may use your data for anything else.

• Google Cloud: the server knowsme runs on, in Iowa, USA (us-central1). Everything passes through it.
• Supabase: the database your notes, keys (hashed) and account are kept in. Locked notes are stored there locked.
• Resend: sends sign-in codes and recovery emails, through Amazon’s email service in Ireland (eu-west-1). It sees your email address and the message, never your notes.

Not on this list, on purpose: the AI apps you connect (ChatGPT, Claude, Gemini and the rest). You choose them, and each reads what you let it read under its own terms. There is no analytics, advertising or tracking company, because there is none on this site.

What is in place today

• Keys are shown once and stored only as SHA-256 hashes. Any key can be revoked on your dashboard, and Disconnect everything cuts off every app at once.
• Read-only keys, for apps that should read your memory but never change it.
• Locked notes: with a passphrase, the database holds nothing readable, not even note names.
• Undo for every change an AI makes, and Erase for good for when you want something gone completely.
• An AI can never write your rules; only you can, on your dashboard.

What is not in place yet, so you can judge for yourself: no outside security audit, no SOC 2 or ISO certificate, no two-factor sign-in, no single sign-on, and no option to host knowsme yourself.