For IT and security review
The answers a review asks for, in the order it asks for them — including the places where the answer is no.
This page exists to be forwarded. If somebody has asked you to get Memtro past IT, security or procurement, the answers are below in the order those reviews ask for them — including the places where the answer is no.
What Memtro is, in one paragraph
Memtro is company memory and 130-odd connectors behind an OpenAI-compatible API and an MCP server. Your people point the tools they already use at it; it retrieves relevant facts into each request, gives the model tools over the systems you connect, and keeps what it learns with provenance. You bring your own model provider keys, so prompts go to providers you already have agreements with and Memtro adds no margin on model usage.
Identity
| Single sign-on | OpenID Connect (Microsoft Entra ID, Okta, or any provider with a discovery document) and SAML 2.0, configured per organisation |
| Enforced sign-in | Yes — one option makes your provider the only route in, with no password or social sign-in for anybody at your verified domains |
| Domain verification | DNS TXT record, required before a provider may sign anybody in at a domain |
| Just-in-time provisioning | Optional, as a user or an admin. An assertion can never create an owner |
| Provisioning | SCIM 2.0: users and groups, with groups mapped to teams |
| Deprovisioning | active: false withdraws access and keeps everything; a hard delete does what you chose in advance |
| Two-factor | Mandatory for every account with a password: TOTP, with single-use backup codes |
| Sessions | Each person can list and end their own; an admin can end a member's; suspension refuses every route including your own provider |
| Price | Included at every tier. There is no enterprise plan that unlocks it |
Details, including what to paste into Entra and Okta: single sign-on and provisioning.
Access control
Nothing shared is usable until a grant says so. Each shared connection has a permissions page with its tools down the side and the organisation and every team across the top; a Slack connection separates searching messages, reading a channel, reading a thread and sending one, so a team can read without ever posting. Reading never implies acting: the tools that change something are marked, granted by name, and used only when a person asks for exactly that.
A team's grants are its own — a child team does not inherit its parent's, deliberately, because quietly widening who may do what is the wrong default. Routing and cost allowances do inherit, because those are settings rather than permissions.
The organisation's knowledge and each person's own notes are separated as each fact is extracted, not by policy afterwards. A personal conversation never writes anything shared.
Audit and accountability
Every administrative change is recorded with who made it and when: members added, promoted, suspended and removed, teams and what each grants, the organisation's base permissions, API keys created and revoked, routing, cost allowances, retention windows, the action policy, connection access, identity providers and provisioning tokens, and every erasure. Provisioning actions are attributed to the identity provider that made them rather than to whoever happened to be signing in.
The log holds no prompts, no answers and no credentials — a verb, who did it, what to, and the before and after of what changed — and the nightly retention sweep does not shorten it. It goes when the organisation goes.
Separately, every request is logged with who made it, which model answered, the tokens it used and what retrieval found. Request logs hold no prompts; one field holds the question as retrieval saw it, kept for a bounded window so retrieval changes can be tested against real questions, and it is stripped by an erasure whoever made the request.
Data handling
| Where it runs | Servers Memtro operates in the European Union |
| Credentials at rest | AES-256-GCM for provider keys and connection tokens |
| Model providers | Yours, under your own keys and their terms. Memtro does not add a provider in between |
| Backups | Taken by the hosting provider |
| Retention | Per organisation, per record type: request logs, chat traces, job runs, progress traces and sync events |
| Erasure | Everything held about a person removed across every store, verified inside the same transaction and receipted |
| Egress | Connectors cannot be steered into probing the machine Memtro runs on |
| Database access | Read-only transactions with a statement timeout and a row cap, under credentials you supply |
The privacy notice and the subprocessor list are the contractual versions of this; a data processing agreement is available on request from the address on that page.
Prompt injection
A ticket, an email or a document can contain instructions aimed at your assistant. Memtro contains that outside the model rather than asking the model to resist it: a turn that has read from a connected system cannot act on what it read without a person agreeing, memory concluded that way is stored unverified and ranked below anything a person said, tool results arrive inside an envelope they cannot forge their way out of, a sandboxed engine reaches credentials through a proxy rather than holding them, and the arguments of an action are checked against who actually asked for what.
It is a containment strategy rather than a guarantee, and the page about it says what it costs and what it does not cover.
Where the answer is no
Worth knowing before you spend a week on a review that ends here.
- No SOC 2, ISO 27001 or HIPAA. None of them are in progress at a date we would commit to. If a certificate is a hard requirement, Memtro does not meet it today.
- One region. European Union only. No US or APAC hosting, no single-tenant deployment, no self-hosted option.
- No data-loss-prevention policy engine. Nothing inspects content on the way through to block, redact or mask it. Access is controlled by grants, not by content inspection.
- The audit log records administrative changes, not every tool call. Tool calls appear in the request log with their connection and outcome, but there is no per-call audit entry with arguments.
- No customer-managed encryption keys, and no bring-your-own-KMS.
- Uptime is reported, not contracted. status.memtro.com checks the application, the database, the renderer and the schedulers, with history. There is no SLA with credits at the self-serve tiers.
Questions a review usually asks next
Can we trial it without connecting production systems? Yes. Memory works from conversations alone, and connectors are added one at a time, each read-only until you grant an action.
What happens to our data if we leave? Cancel and access continues to the end of the paid period. Delete the organisation and everything it holds is wiped, everybody is signed out, and accounts remain so people can join another organisation. Usage statistics export to CSV while you are a customer.
Who can see our memory? The people in your organisation, scoped by team grants and the personal/shared split. Memtro's own staff do not read customer memory in the ordinary course of operating the service; support access would be asked for and is not a standing permission.
Does Memtro train on our data? No. Your content is not used to train anything, by Memtro or in aggregate across customers.
Can we restrict which models our people use? Yes, and most organisations do: routing picks a model per request from a ladder you set, and a lock keeps requests on that ladder so nobody can name a model directly.
Getting a conversation started
Write to sales@memtro.com with what your review needs. If the blockers above are the blockers, say so early and we will tell you plainly whether it is worth either side's time.