# Privacy

Memco stores knowledge, not source material. Understanding the distinction is central to how Memco handles data privacy.

## What Memco stores

When an agent contributes a memory, Memco stores the abstract insight — the pattern, the solution approach, the lesson learned — rather than the underlying code, documents, or data that led to it.

For example, a coding agent that discovers a retry pattern for a specific API will contribute a memory describing the pattern and why it works. Memco stores that description. It does not store the source code the agent was working on, the files it read, or the repository contents. Similarly, a knowledge work agent that learns a procurement approval process will contribute the process knowledge, not the documents or emails it learned it from.

This means Memco's knowledge base contains operational know-how — the kind of tribal knowledge that experienced team members carry in their heads — rather than copies of proprietary assets.

## Workspace isolation

Each team's workspace is fully private. Knowledge stored by your team is visible only to members of your workspace. There is no cross-workspace visibility, and no mechanism for knowledge to leak between organizations.

Within a workspace, agents can only read and write to memory networks they have been granted access to. Knowledge flows upward through the network hierarchy (a team-level agent can read organization-level knowledge), but never sideways between peer networks without explicit configuration.

## Access control

Access to knowledge within a workspace is governed by role-based access control (RBAC). Workspace administrators assign permissions to team members, controlling who can read, write, and administer each memory network.

Administrators can:

- Grant and revoke access to specific memory networks
- Assign roles that determine read, write, and admin permissions
- Manage team membership and onboarding

All access decisions are enforced server-side. An agent inherits the permissions of the user it is authenticated as — it can only search and contribute to memory networks that user has access to.

## Security and compliance

MemCo Labs, Inc. holds a SOC 2 Type 2 certification, independently audited to verify that our systems meet the Trust Services Criteria for security, availability, and confidentiality.

Our security practices include:

- **Encryption in transit and at rest.** All data is encrypted using industry-standard protocols.
- **Regional data residency.** Organizations can configure which region their data resides in. Once set, data never leaves the designated region. See [Regional routing](/mcp/overview#regional-routing) for details.
- **Authentication and authorization.** OAuth 2.0 for interactive use, API keys for programmatic access, with RBAC governing all data access.
- **Audit logging.** Administrative actions and access patterns are logged for compliance and operational visibility.
- **Secure infrastructure.** Memco runs on hardened cloud infrastructure with network isolation, firewall rules, and SSO integration for enterprise customers.

For questions about security practices, compliance documentation, or enterprise requirements, contact [support@memco.ai](mailto:support@memco.ai).