Security & Vulnerability Disclosure
How Memora Keep keeps your data local, what that design does and does not protect against, and how to report a vulnerability to us.
Last updated
Memora Keep stores your archive on your own computer. This page explains that design, what it does and does not protect against, and how to tell us about a vulnerability.
The short version
Your data is stored locally, on a disk you control, with no account and no server in the loop. The app does not use encryption at rest yet. That work is planned and is described below. If you find a security problem, the disclosure process is also below.
Local storage by design
Backups, media and the archive are written to a folder you choose. The archive is a local SQLite database with files stored by type and by device. There is no account and no sign-in, so there is no password of yours stored on a server and nothing to synchronize. The app also runs a single instance at a time and keeps a local log for diagnosing problems.
No account to attack
Because there is no sign-in, there is no session token, no server-side profile and no online account that could be guessed, phished or reused. This removes a whole class of risk rather than mitigating it.
What this design does not protect against
Local-first keeps your data from being collected, but it does not make the computer invulnerable. Anyone with access to your unlocked computer and your user account can read the folder. A disk that is lost, stolen or handed on can be read by whoever gains access to it, unless you use the full-disk encryption that your operating system provides. Protect your computer account and your disk accordingly.
Encryption is planned, not shipped
Encryption of the archive and of backups is on the roadmap for a later phase, so it is not part of the app today and you should not rely on it. When it ships, the product documentation and this page will describe how it works before any claim is made about it.
Reporting a vulnerability
If you believe you have found a security issue, please tell us before telling anyone else. Use the contact page and describe the problem, marking it as a security report so it reaches the right place. Please do not test against other people’s data or devices.
What to include in a report
A clear description of the issue and its impact, the steps needed to reproduce it, and the version of the app you are running along with your operating system. Please do not include real personal data from an archive in a report, and do not attach a real backup.
What to expect from us
We will acknowledge your report and keep you informed while we look into it. We will tell you when a fix is available, and we will credit you for the finding if you would like us to. We ask that you give us a chance to fix the issue before you disclose it publicly.
Questions about this document?
If something here is unclear, or if you need to raise a privacy, security or licensing matter, the support and contact pages are the place to start.