Privacy Policy

EngramPort is a product of Covenant Systems AI LLC, a North Carolina limited liability company. We are the controller of your personal data when you use EngramPort.

Account information. When you sign up we receive your email address (and, if you authenticate via GitHub, your GitHub username and profile picture). Authentication is handled by Supabase on our behalf.

Payment information. If you subscribe to a paid plan, payment details (card numbers, billing address) are collected and handled by Stripe. We never see or store raw payment card data; we receive only a Stripe customer identifier and billing status.

Your memories and namespaces. The content you actively store in EngramPort — memories, insights, principles, and the graph structure connecting them. This data lives in our database in Google Cloud (us-east1).

Your LLM provider key. If you submit a Bring-Your- Own-LLM provider key (Anthropic, OpenAI, Google, etc.), we store it encrypted at rest. We use it only to make inference calls on your behalf and never share it.

Usage and operational data. Standard server logs (request paths, status codes, response times, IP addresses, timestamps) for the purpose of operating and securing the service. Token-cost ledger entries for billing accuracy.

We do not collect: cross-site tracking data, advertising IDs, location data beyond IP, biometric data, or anything we don't need to operate the service.

We use the information we collect to:

• Operate and provide EngramPort to you.
• Process payments for paid plans (via Stripe).
• Make inference calls to your chosen LLM provider on your behalf.
• Send you transactional emails about your account (e.g., signup confirmation, billing receipts, security alerts).
• Provide customer support when you reach out to us.
• Investigate abuse and protect the service from attack.
• Comply with legal obligations.

We do not use your stored memories to train models. Your memory content is your data, used solely for operating the service for you. We do not sell or rent your information to anyone.

We rely on the following sub-processors to operate the service. Each is bound by their own privacy and security commitments.

• Google Cloud Platform (us-east1) — hosting, compute, storage, networking.
• Supabase — authentication and tenant metadata database (us-east-1).
• Stripe — payment processing for paid plans.
• Vercel — hosting for engramport.com and the customer dashboard.
• Cloudflare — DNS and edge routing for the engramport.com domain.
• OpenAI (and, in the future, additional LLM providers we offer as platform defaults) — limited to internal synthesis operations (dream, groom) when a customer has not provided their own provider key. For Bring-Your-Own-LLM customers, inference goes to the provider whose key the customer supplied.
• npm registry (operated by GitHub) — distribution of the engramport npm package.

If we add new sub-processors that handle personal data, we will update this list.

Account data + memories: retained while your account is active. Deleted within a reasonable window after account closure (typically within 30 days). Backups containing your data are purged within 90 days of account closure.

Server logs: retained for 30 days for operational and security purposes, then deleted or aggregated to non-identifying form.

Token-cost ledger: retained for the longer of (a) 12 months and (b) the period required for billing reconciliation with your most recent invoice.

Stripe billing records: retained per Stripe's retention policies, typically for as long as required by tax and accounting law (usually 7 years).

We employ the following safeguards:

• Encryption in transit: all API and dashboard traffic uses TLS 1.2 or higher.
• Encryption at rest: data stored in Google Cloud and Supabase is encrypted at rest using provider-managed keys.
• API key hygiene: raw API keys (ek_ keys) are shown only once at signup and stored as SHA-256 hashes server-side. We cannot recover a lost key; we can issue a replacement and invalidate the previous one.
• Provider key encryption: Bring-Your-Own-LLM provider keys are encrypted at the application layer before being written to the database.
• Provenance ledger: memory writes are cryptographically signed (RSA-PKCS1-v1.5 + SHA-256 dual-strand) via our AEGIS layer so tampering is detectable.
• Tenant isolation: API keys are scoped to specific namespaces; cross-tenant access is enforced at every API call.
• Access controls: production database access is restricted to the engineering team and gated by GCP IAM.

No system is perfectly secure. If you discover a vulnerability, please report it to hello@covenantsystems.ai — we appreciate responsible disclosure and will respond promptly.

You have the right to:

• Access the personal data we hold about you. Email us and we will provide it.
• Export your memories. Email us with your tenant slug and we will provide an export. The self-service export UI ships in a later release.
• Delete your account and the data we hold about you. Email us with your tenant slug to initiate deletion. The self-service delete UI ships in a later release.
• Correct inaccurate personal data we hold about you.
• Object to certain processing or restrict it.

We will respond to data-rights requests within 30 days. There is no charge for exercising your rights.

If you are located in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively. We comply with these where applicable.

We use cookies sparingly. The engramport.com site sets a Supabase authentication cookie when you sign in, used to keep you signed in across page loads. We do not use third-party advertising cookies, tracking pixels, or cross-site analytics tracking.

EngramPort is hosted in the United States (Google Cloud us-east1 and Supabase us-east-1). If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. By using the service you consent to this transfer.

For customers in the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses for the transfer of personal data to the U.S. where applicable.

EngramPort is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If you become aware that a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the service evolves. Material changes will be announced via email or through engramport.com before they take effect. The "Effective" date at the top of this document reflects the current version.

For any privacy question, data-rights request, or security report, email hello@covenantsystems.ai. We do not have a dedicated data protection officer; the founding team handles privacy matters directly.