Data flow

Components and their data flows

Path A: Sign in with a magic link

Your browser ─► knowmind.de (HTTPS, TLS 1.3)
                  └─► mail generation
                       └─► Brevo (EU) ─► your inbox
                                          └─► you click the link
                                               └─► knowmind.de establishes a session

Content: your email address, the link token, standard headers. Brevo sees only the recipient address and the mail body ("Your sign-in link"). Brevo does not store workspace content.

Path B: Create a memory via the dashboard

Your browser ─► knowmind.de (HTTPS)
                  └─► Control plane (Next.js)
                       ├─► PostgreSQL (tenant column, Hetzner)
                       ├─► embedding service ─► pgvector
                       └─► Knowledge Graph (Neo4j, Hetzner)

Content stays inside the knowmind infrastructure in Germany. If a BYOK provider is configured for enrichment, path D runs in addition.

Path C: Recall via an MCP client (Claude Code, ChatGPT, Claude.ai)

AI client ─► knowmind.de/api/mcp/v1 (HTTPS, bearer token)
                └─► control plane
                     ├─► PostgreSQL (BM25, vector)
                     ├─► Knowledge Graph (graph hops)
                     └─► response (JSON-RPC) ─► AI client
                                              └─► model answer to you

The language model itself runs at the AI provider (Anthropic for Claude, OpenAI for ChatGPT). knowmind sees neither your prompt content nor the model's answer — only the recall request and the hits returned.

Path D: BYOK enrichment

Control plane ─► provider adapter (clear-text key in RAM)
                  └─► provider (Anthropic / OpenAI / Mistral / …)
                       └─► response ─► control plane ─► database

Content only reaches the provider when you have enabled BYOK. Your key sits encrypted (AES-256-GCM) in the database, is decrypted at call time and lives in the adapter's RAM for the duration of one call. No logs, no tracing fields, no stack traces carry the clear text.

Path E: Webhook outbound

Event (memory, edge, plan) ─► webhook queue
                                      └─► webhook worker
                                           └─► HTTP POST to your URL
                                                (HMAC-SHA256 signed)

knowmind only sends to webhook targets registered in the dashboard. The body is minimised (IDs, timestamps, event type). Full memory content is not sent — your endpoint can pull it via the API when needed.

Subprocessor list (as of 23 May 2026)

The complete list with purpose and contractual basis is part of the DPA. Request by email at info@schuebeler-consulting.de.