Governance, security and EU AI Act
The core memory path can stay in your configured local data root — memory your team controls. Enterprise deployments add per-workspace isolation, role-based access, GDPR controls, and a per-mode EU AI Act self-assessment. Optional providers, connectors, backups, proxies, model downloads, and client applications require separate review. A technical-control map for EU AI Act and GDPR obligations — not legal advice or a certification. Applicability depends on your deployed use case, data, operator role, and surrounding system.
Six control areas.
Engineering controls documented for each deployment surface. Per-workspace isolation and role-based access apply to all modes.
Local Core Storage
The canonical memory source is SQLite-backed. Include indexes, models, logs, and other profile state in backup, export, and deletion procedures.
Mode A Provider Boundary
Mode A does not require an OpenAI or Anthropic key for the core memory-content path. Other modes and optional integrations can require credentials and network calls.
Inspect Network Behavior
The core tool does not require product analytics for memory operations. Audit the installed release and every optional integration for the configured deployment.
Local Mode A Core Path
Mode A does not require a model provider for core memory processing. Optional connectors, backups, proxies, and downloads can still use the network.
Governance & EU AI Act
Per-workspace isolation, role-based access, GDPR access/erasure/portability, and a hash-chained audit trail. A per-mode EU AI Act self-assessment maps each mode. These are engineering controls, not a certification of the operator or surrounding system.
Open Source (AGPL v3)
Full source code is public and auditable. Verify the installed release, optional dependencies, configured providers, connectors, and client applications.
Where data lives, and how it moves.
Five surfaces. Each requires its own assessment for a complete deployment review.
Compare privacy attributes.
Attributes are deployment-configuration-dependent. Review network behavior independently for each configured integration.
| Privacy Attribute | SuperLocalMemory | Cloud-Based Alternatives |
|---|---|---|
| Data location | Configurable local core; optional external paths | Provider-dependent |
| API keys needed | Not for Mode A core; mode-dependent | Provider-dependent |
| Offline core path | Available in Mode A after dependencies/models are present | Provider-dependent |
| Network calls | Configuration-dependent and inspectable | Provider-dependent |
| Open source | AGPL v3 source | Varies |
| Self-hosted option | Local-first core | Varies |
| License | AGPL v3 | Varies by provider |
Role-based access and workspace isolation.
Three roles per workspace. Workspaces are isolated — one workspace cannot read another workspace's memories. Single-user installs require no login.
require_login setting activates authentication; first-run admin account creation is required; no default credentials shipped.Subject rights and data controls.
Technical controls that can support GDPR subject-rights procedures. The operator must validate completeness against the full deployment, including derived stores, backups, clients, and logs.
slm export. Supplies all stored memory records for a workspace. Verify completeness across indexes, logs, backups, and surrounding systems.Per-mode EU AI Act self-assessment and article-by-article mapping: EU AI Act →
Three modes, three postures.
SuperLocalMemory ships a per-mode EU AI Act self-assessment. It is a technical-control map, not a legal certification — applicability depends on deployment, data, operator role, and surrounding system.
Self-assessment tooling, not a certification. Checker results cover the core memory-content path only. Optional connectors, backups, client applications, and model downloads retain their own network behavior and must be assessed separately.
Regardless of mode: GDPR access / erasure / portability (Art. 15, 17, 20), a hash-chained audit trail, per-workspace isolation, opt-in PII redaction, and admin/member/viewer role-based access. See Governance & EU AI Act controls →
Bounded loops and durable ledgers.
Bounded-loop runs write a durable, auditable ledger. Each iteration is tagged and reviewable — relevant for human-oversight and traceability obligations under EU AI Act Art. 14.
✓ Loop started · tag: loop:review-cycle · ledger: durable iter 1/5 · op_id: <opaque-id> · state: complete iter 2/5 · op_id: <opaque-id> · state: complete ✓ Bounded loop complete · 5/5 iterations logged to audit ledger
# Inspect the loop audit history $ slm loop history review-cycle --json "iterations": 5 · "all_logged": true · "ledger_hash": "sha256:..."
Article-by-article self-assessment.
How each relevant EU AI Act and GDPR requirement maps to Mode A and Mode C in the built-in checker. Self-assessment posture only — not a legal compliance determination.
| Article | Scope | Mode A self-assessment posture | Mode C self-assessment posture |
|---|---|---|---|
| Art. 10 — Data Governance | Data quality, relevance, and representativeness requirements may apply to the complete system. | ✓ local path Local controls and export tools provide evidence; the operator verifies data quality and governance. | ⚑ provider-flagged Provider processing and terms become part of the assessment. |
| Art. 13 — Transparency | Applicable systems may need information that lets deployers interpret outputs. | ✓ local path Candidate, fusion, and reranker diagnostics provide retrieval evidence. | ⚑ provider-flagged Model synthesis adds another component to document. |
| Art. 14 — Human Oversight | Humans must be able to understand, intervene, and override AI decisions. | ✓ local path Full dashboard visibility. Trust gates. Manual memory management. | ✓ local path Same oversight tools available. Cloud LLM output can be reviewed before use. |
| GDPR Art. 15 — Right of Access | Applicable deployments may need a complete subject-access procedure. | ✓ local path SLM export tools supply part of the evidence; indexes, logs, backups, clients, and surrounding systems remain in scope. | ⚑ provider-flagged Include provider-held data and logs in the complete procedure. |
| GDPR Art. 17 — Right to Erasure | Applicable deployments may need verified erasure across every copy and processor. | ✓ local path Hard delete with verification; operation logged before execution. Verify derived state, backups, and surrounding systems separately. | ⚑ provider-flagged Verify local deletion and the provider's deletion and retention process. |
| GDPR Art. 20 — Right to Portability | Applicable deployments may need structured, machine-readable export for portability. | ✓ local path SLM export produces structured, machine-readable JSON output. Verify completeness against all local data stores. | ⚑ provider-flagged Include provider-held data representations in the portability scope. |
"Local path" and "provider-flagged" are outputs of the built-in checker — not legal determinations. Mode B follows the same local-path assessment as Mode A. Engage qualified legal counsel for the complete compliance evaluation of your deployed system.
