Security
Built so that the record cannot quietly change.
GrantAi keeps memory where you put it, seals every record, and sends the least it can to anyone else. This page says exactly what that means for each product, who processes what, and how to reach us when something is wrong.
Last reviewed November 8, 2026
Where your data lives
GrantAi memory server
Developers and enterprises
Runs on your machine or inside your network. Memories are written to a local database; nothing is sent to SolonAI to store or search them.
The licensed edition checks its license key against solonai.com. The free developer edition makes no calls to us at all.
GrantAi Personal
iPhone and Android
Memories live in an encrypted database inside the app on your phone. Backups go to your own iCloud or Google account, never to ours.
When you ask a question, the question, the memories it matched and the recent messages of that conversation pass through our relay to the Google Gemini API, which writes the answer. Neither we nor Google store them. Details are in the Privacy Policy.
GrantAi Remembers
Memory shared across the AI assistants you connect
Memories stay on your phone. The relay at connect.grantai.ai carries each recall and save between the assistant and the phone and keeps no copy of the content.
The relay holds a random phone identifier, a hash of its secret, and one row per connected assistant. Details are in the Remembers privacy page.
Encryption and sealing
At rest
Memory databases are encrypted with AES-256. On the phone the database also sits inside the app's private storage, under the device's own encryption and lock. On a server the key is yours; we never hold it.
Sealed records
Every record is stored verbatim with the time it was sealed and a SHA-256 hash. Records are chained, so the hash of each one covers the one before it. A record that is edited, reordered or removed breaks the chain, and a verification pass reports the first sequence number that no longer matches. Deleting a record leaves a dated tombstone rather than a gap.
In transit
Everything that moves between your device, our relays and our subprocessors is encrypted with TLS. The free developer edition and the licensed memory server speak to your AI tools over a local connection on your own machine.
What we do not do
- Store, read or search your memories on our servers. We hold none, for any product.
- Use your content to train AI models, ours or anyone else’s.
- Sell personal information or use it for advertising.
- Alter or delete a sealed record silently. Deletions leave a dated tombstone in the chain.
Subprocessors
Third parties that process data on our behalf, what they do, and what reaches them. Memory content reaches exactly one of them, Google, and only for GrantAi Personal answers, with your permission.
| Provider | Purpose | What reaches them |
|---|---|---|
| Google LLC (Gemini API) | Writes the answers in GrantAi Personal. Does not retain requests or use them for training. | The question, matched memories, recent conversation messages, optional location, and documents or photos you add. |
| Apple Inc. and Google LLC (App Store, Google Play) | Sell and renew Personal subscriptions. | Purchase records. We receive the transaction identifier to confirm a subscription. |
| Apple Push Notification service and Firebase Cloud Messaging | Wake the GrantAi Remembers app when an assistant calls. | A push token that identifies the app on your phone, not you. |
| Cloudflare, Inc. | Runs the Remembers relay and serves downloads. | Relay metadata described above; download logs. |
| Vercel Inc. | Hosts this website and the Personal answer relay. | Request logs; requests in transit. |
| Stripe, Inc. | Bills licensed memory-server plans bought on this site. | Billing name, email and payment details, held by Stripe. |
| Resend | Sends license keys and transactional email. | Email address and the message. |
| Google (Analytics and Ads tags) | Measures visits to this website. | Standard web analytics. No memory content is ever on this website. |
Compliance status
SOC 2. SolonAI does not hold a SOC 2 report today. A Type I examination is on the roadmap, and we will publish the date here once an auditor is engaged. Until then, enterprise customers receive our completed security questionnaire, this architecture description and a walkthrough of the sealing and verification design on request.
Records rules. The sealed chain is designed to support the retention and tamper-evidence requirements that financial-services and AI regulations place on records, including SEC Rule 17a-4(f) and Article 12 of the EU AI Act for high-risk systems. Whether a given deployment meets a given rule depends on how it is operated; we document the controls, your compliance team maps them.
Data residency. The memory server runs wherever you run it. Nothing about a self-hosted deployment is sent to SolonAI except the licensed edition's key check.
Reporting a vulnerability
If you believe you have found a security issue in any GrantAi product, this website or the relays, email us with the subject line Security. Security reports are read first. We acknowledge within two business days, keep you informed while we work on it, and credit you if you wish once it is fixed. Please give us a reasonable time to fix before publishing, and do not access or alter data that is not yours.
support@solonai.comPolicies: Privacy Policy · GrantAi Remembers privacy · Terms of Service