Explicit identity
Browser-based OAuth keeps authorization visible and avoids credentials in setup commands.
Loading
Security foundation
GraphMem is in private preview. This page describes the architecture principles shaping the service, not a completed compliance claim.
Browser-based OAuth keeps authorization visible and avoids credentials in setup commands.
Agents receive revocable, least-privilege access instead of permanent account credentials.
The frontend, identity service, control plane, MCP runtime, and data layer have distinct responsibilities.
Service authorization is authoritative. Client-side presentation is never treated as an access control.
Trust boundary map
This is a conceptual map of responsibility, not a live deployment topology or a compliance diagram. Browser presentation can show consent and state; server-owned policy and storage remain authoritative.
Codex, Claude Code, or another supported client asks for context through an approved MCP connection.
Review client preparationA planned hosted MCP endpoint mediates the agent request; this public page does not inspect memory or grant access.
Review endpoint setupBrowser sign-in and consent make identity, project, and requested capabilities visible to the user.
Review planned authorizationOwning services enforce membership, scope, visibility, and limits before data is returned or changed.
Read server enforcementMemory storage remains behind the owning service; the frontend does not connect directly to storage or turn a browser filter into authority.
Read ownership principleCurrent frontend
The public pages are prerendered and have no sign-up form, analytics, or tracking cookies; your theme choice stays in your own browser. The console at console.graphmem.sezer.ai is a signed-in application with the data path below.
__Host-graphmem-console, marked HttpOnly, Secure, and SameSite=Lax. It holds only an opaque handle to a server-side session; access tokens stay on the server and are not readable by page scripts. Disconnecting expires the cookie and ends the session./api routes. Those server routes attach the session's authorization and forward bounded requests to the GraphMem service and the Sezer Labs control plane, which enforce membership and scope. The console reads your organizations, projects, entitlements, agent connections, and read-only views of the memory graph (statistics, search, recall, projections, node details, and audit results). The frontend has no database connection and holds no provider secrets in the browser.See the privacy draft for how this data is handled.
Security findings should be reported privately through the GitHub security advisory flow for the GraphMem frontend repository.