The core memory path can stay in your configured local data root — memory your team controls. Enterprise deployments add per-workspace isolation, role-based access, GDPR controls, and a per-mode EU AI Act self-assessment. Optional providers, connectors, backups, proxies, model downloads, and client applications require separate review. A technical-control map for EU AI Act and GDPR obligations — not legal advice or a certification. Applicability depends on your deployed use case, data, operator role, and surrounding system.
Every save passes an admission check and gets a receipt. Every read respects roles, workspaces and scopes. Every erasure reaches every copy. Every action lands in a hash-chained audit trail. These are engineering controls that support a compliance program, not a certification.
Admin, member and viewer, per workspace. A workspace is a profile with its own memory, members, retention policy and audit trail. Maintenance and approvals act only where you are. With company mode, every read and write is attributed to a signed-in person, and with login required the check runs before the request body is read.
Teams guide → Company mode →A save returns a durable receipt as it moves raw, then queryable, then complete. An erasure stores a receipt written after every step, so it cannot read complete over a failed sweep. slm gdpr erase --json reports success: false for an incomplete erasure and says what remains and which step retries it.
Erasure removes the relational rows, the full-text and vector indexes, queued saves, caches, the reversible originals kept by compression, summaries, the persona, scene titles, write receipts, and an erased picture’s stored original and backup mirror. SLM checks the bytes of the data folder afterwards. Backups cannot be rewritten, so each one that holds the profile becomes an erasure obligation, replayed on every restore until it is deleted or found clean.
Compliance guide →Access-control events (user and role changes, policy changes, sign-ins) and memory operations are chained with SHA-256 plus an external count-and-head anchor. The chain detects edits and truncation; someone able to rewrite both files could recompute it. Per-profile retention rules and an EU AI Act posture report sit beside it.
Audit trail →While your computer is idle, older memories get dates, names, projects and kinds filled in, only by adding and never over a value you set. Repairs that move or delete wait for your Fix, and every run can be undone. Pausing, Fix and Undo need management permission for the workspace.
Memory health guide →Every memory records which agent wrote it, and Bayesian trust scores defend against memory poisoning, so several agents can share one memory. Recalled text is treated as untrusted evidence: secrets redacted, forged markers neutralised, provenance attached. Mutation authority never comes from a caller-chosen agent name.
Scopes guide → The trust paper →Files you exported, cloud backups already uploaded and another computer’s data folder are yours to remove; SLM says so in the receipt. Not legal advice or a certification.
In Mode A, core remember and recall can store and retrieve through your local data root with no model-provider call: no API key, no cloud account, no Docker. Anything that sends data out is a choice you make, and each one states exactly what goes.
| What leaves | Only when |
|---|---|
| A question and the top three memories | You turn on Jev, the online answer check, and tick its consent |
| Memory text | You choose Mode C, a cloud embedder or reranker, a model on another computer, or Jev kind typing (its own consent) |
| Encrypted backup files | You connect GitHub or Google Drive backup |
| Mesh messages | You configure mesh peers, or allow a web app to message your bots |
| Tool calls from web apps | You turn on Web access and add an app; the database stays on your computer |
Pictures, documents, Laya and Mode A never send anything. Secrets in memory text are redacted on every outbound path. Profiles are a recall boundary inside one installation, not a substitute for operating-system accounts: on a Mac shared by several accounts, turn on company mode.
Engineering controls documented for each deployment surface. Per-workspace isolation and role-based access apply to all modes.
The canonical memory source is SQLite-backed. Include indexes, models, logs, and other profile state in backup, export, and deletion procedures.
Mode A does not require an OpenAI or Anthropic key for the core memory-content path. Other modes and optional integrations can require credentials and network calls.
The core tool does not require product analytics for memory operations. Audit the installed release and every optional integration for the configured deployment.
Mode A does not require a model provider for core memory processing. Optional connectors, backups, proxies, and downloads can still use the network.
Per-workspace isolation, role-based access, GDPR access/erasure/portability, and a hash-chained audit trail. A per-mode EU AI Act self-assessment maps each mode. These are engineering controls, not a certification of the operator or surrounding system.
Full source code is public and auditable. Verify the installed release, optional dependencies, configured providers, connectors, and client applications.
Five surfaces. Each requires its own assessment for a complete deployment review.
Attributes are deployment-configuration-dependent. Review network behavior independently for each configured integration.
| Privacy Attribute | SuperLocalMemory | Cloud-Based Alternatives |
|---|---|---|
| Data location | Configurable local core; optional external paths | Provider-dependent |
| API keys needed | Not for Mode A core; mode-dependent | Provider-dependent |
| Offline core path | Available in Mode A after dependencies/models are present | Provider-dependent |
| Network calls | Configuration-dependent and inspectable | Provider-dependent |
| Open source | AGPL v3 source | Varies |
| Self-hosted option | Local-first core | Varies |
| License | AGPL v3 | Varies by provider |
Three roles per workspace. Workspaces are isolated — one workspace cannot read another workspace's memories. Single-user installs require no login.
require_login setting activates authentication; first-run admin account creation is required; no default credentials shipped.Technical controls that can support GDPR subject-rights procedures. The operator must validate completeness against the full deployment, including derived stores, backups, clients, and logs.
slm gdpr export --profile NAME --output export.json. The file describes what it omits under export_manifest. Verify completeness across indexes, logs, backups, and surrounding systems.slm gdpr erase --profile NAME --dry-run previews; --yes erases irreversibly across every store and derived copy, and the result lists what was removed and what remains. Backups carry an erasure obligation until cleared. Verify backups and any surrounding systems separately.--include-embeddings), suitable for data portability requests. Verify completeness against all local data stores in the deployment.Per-mode EU AI Act self-assessment and article-by-article mapping: EU AI Act →
SuperLocalMemory ships a per-mode EU AI Act self-assessment. It is a technical-control map, not a legal certification — applicability depends on deployment, data, operator role, and surrounding system.
Self-assessment tooling, not a certification. Checker results cover the core memory-content path only. Optional connectors, backups, client applications, and model downloads retain their own network behavior and must be assessed separately.
Regardless of mode: GDPR access / erasure / portability (Art. 15, 17, 20), a hash-chained audit trail, per-workspace isolation, opt-in PII redaction, and admin/member/viewer role-based access. See Governance & EU AI Act controls →
Bounded-loop runs write a durable, auditable ledger. Each iteration is tagged and reviewable — relevant for human-oversight and traceability obligations under EU AI Act Art. 14.
How each relevant EU AI Act and GDPR requirement maps to Mode A and Mode C in the built-in checker. Self-assessment posture only — not a legal compliance determination.
| Article | Scope | Mode A self-assessment posture | Mode C self-assessment posture |
|---|---|---|---|
| Art. 10 — Data Governance | Data quality, relevance, and representativeness requirements may apply to the complete system. | ✓ local path Local controls and export tools provide evidence; the operator verifies data quality and governance. | ⚑ provider-flagged Provider processing and terms become part of the assessment. |
| Art. 13 — Transparency | Applicable systems may need information that lets deployers interpret outputs. | ✓ local path Candidate, fusion, and reranker diagnostics provide retrieval evidence. | ⚑ provider-flagged Model synthesis adds another component to document. |
| Art. 14 — Human Oversight | Humans must be able to understand, intervene, and override AI decisions. | ✓ local path Full dashboard visibility. Trust gates. Manual memory management. | ✓ local path Same oversight tools available. Cloud LLM output can be reviewed before use. |
| GDPR Art. 15 — Right of Access | Applicable deployments may need a complete subject-access procedure. | ✓ local path SLM export tools supply part of the evidence; indexes, logs, backups, clients, and surrounding systems remain in scope. | ⚑ provider-flagged Include provider-held data and logs in the complete procedure. |
| GDPR Art. 17 — Right to Erasure | Applicable deployments may need verified erasure across every copy and processor. | ✓ local path Hard delete with verification; operation logged before execution. Derived copies that quote the memory are withheld and removed automatically, and backup residue is tracked as an obligation. Verify backups and surrounding systems separately. | ⚑ provider-flagged Verify local deletion and the provider's deletion and retention process. |
| GDPR Art. 20 — Right to Portability | Applicable deployments may need structured, machine-readable export for portability. | ✓ local path SLM export produces structured, machine-readable JSON output. Verify completeness against all local data stores. | ⚑ provider-flagged Include provider-held data representations in the portability scope. |
"Local path" and "provider-flagged" are outputs of the built-in checker — not legal determinations. Mode B follows the same local-path assessment as Mode A. Engage qualified legal counsel for the complete compliance evaluation of your deployed system.
Read the guidesCompliance guide · Teams and roles · Company mode · Scopes · Restore points · Cloud backup · Security policy
