Security on several levels
knowmind is built defensively on purpose. Data is encrypted in transit and in the database, every tenant sees only their own memories, and every security-relevant action is logged so it can be traced.
Putting a company's knowledge into a system means extending a great deal of trust. knowmind is built so that as little of that trust as possible has to be taken on faith. Instead of a single safeguard that can fail when it matters, several independent protections work into each other.
Your credentials survive even a database theft
Everything exchanged between your browser or your AI tool and knowmind is protected by modern transport encryption. The provider keys you store are encrypted per workspace with AES-256-GCM, account passwords are held only as an scrypt hash, and access tokens only as a check value. Anyone who got hold of a database dump would have neither your passwords nor your provider keys.
A software bug cannot hand out other people's data
Every workspace is technically separated from all others — in the database itself, one layer below the application. Even if a software bug were to set the wrong filter, the database would reject the query and return nothing. That way your memories stay protected even when something goes wrong.
Without a password there is none to steal
By default you sign in without a password: each sign-in sends you a one-time link by email that expires on its own after a short while. If you prefer the classic route, you can set a password in your profile and sign in with it. If you set none, there is none that could be stolen. Repeated sign-in attempts and systematic querying are throttled on the server.
Other websites cannot trigger anything in your name
Write operations are additionally checked for whether they really come from the knowmind interface. Manipulated links or forms injected from other websites therefore have no effect. Programmatic access over the interfaces is exempt from this — there the API key does the protecting.
You can see who did what, and when
All security-relevant events are logged: sign-ins, creation and revocation of access tokens, adding new AI keys, plan changes, creation of new workspaces. The log can be exported from the dashboard as a file and in that form is enough as evidence for common security audits. Retention follows the plan: 30 days on Private, 90 days on Pro, 12 months on Team, 24 months on Business and 5 years on Enterprise.
Technical detail
- Transport encryption TLS 1.3 with HSTS preloading
- Encrypted storage volumes for databases
- Tenant separation through row-level security with the FORCE attribute
- Sign-in by one-time link, valid 24 hours, redeemable once; optional password per account
- Your own AI keys encrypted per tenant (AES-256-GCM)
- Security review May 2026: eleven findings, all fixed or documented with reasons