Security Whitepaper

Architecture Overview

REM Labs provides a memory infrastructure API that stores, indexes, retrieves, and consolidates memory data for AI agents and applications. The architecture is designed for security, simplicity, and self-hostability.

For self-hosted deployments, the architecture collapses to a single container: your application communicates directly with the REM API running on your infrastructure, with SQLite on local disk or mounted volume. No external dependencies are required.

Key architectural properties

• No external database dependency. SQLite runs embedded, eliminating an entire class of network-based attack vectors.
• Stateless API. The API server is stateless and horizontally scalable. All state lives in SQLite.
• No outbound calls. In self-hosted mode, the API makes zero outbound network requests. All processing is local.
• Minimal attack surface. The API exposes a focused set of REST endpoints. No GraphQL, no WebSockets, no server-side rendering.

Encryption

REM Labs employs encryption at every layer of the data lifecycle.

Authentication

Authentication is handled via API keys for programmatic access and OAuth 2.0 / SAML for interactive access.

API key security

• Keys are generated using cryptographically secure random number generation (256 bits of entropy).
• Keys are displayed exactly once at creation time. They are immediately SHA-256 hashed before database storage.
• Key lookup is performed by hashing the provided key and comparing against stored hashes. No plaintext comparison ever occurs.
• Keys can be scoped to specific operations, namespaces, or time windows on Business and Enterprise tiers.
• Key rotation is supported with zero-downtime overlap periods.

SSO / Enterprise authentication

• SAML 2.0 supported on Business and Enterprise tiers. Compatible with Okta, Azure AD, OneLogin, and other SAML IdPs.
• OpenID Connect (OIDC) supported for Google Workspace, Azure AD, and custom OIDC providers.
• SCIM 2.0 provisioning on Enterprise tier for automated user lifecycle management.
• MFA enforcement can be required at the organization level via SSO provider configuration.

Authorization

REM Labs implements defense-in-depth authorization with multiple isolation boundaries.

Namespace isolation

Every memory operation is scoped to a namespace. Namespaces provide hard data boundaries -- a request authenticated with one namespace's credentials cannot read or write data in another namespace. This isolation is enforced at the database query level, not just the application layer.

Role-Based Access Control (RBAC)

Data Handling

REM Labs follows strict data handling principles designed to give customers full control over their data.

Data retention

• Configurable retention. Customers can set per-namespace retention policies. Options include indefinite storage, TTL-based auto-expiry, or manual purge.
• Right to erasure. Memory deletion via the API is immediate at the application layer. Deletion propagates to backups within the backup rotation window (6 hours).
• Account termination. Upon account deletion or contract termination, all data is purged within 30 days, including backups. Certification of deletion is available upon request.

Data residency

• US (default): Data processed and stored in the United States (Railway US region).
• EU (Enterprise): Data processed and stored within the European Economic Area.
• Self-hosted (any region): Customer controls all data location when self-hosting.

Audit Logging

Every API call to REM Labs is logged with a comprehensive audit trail. Audit logs are immutable and designed to support compliance audits and security investigations.

What is logged

Log export

Audit logs are exportable in JSON and CSV formats via the admin dashboard or API. Enterprise customers can configure log forwarding to external SIEM systems.

Incident Response

REM Labs maintains a documented incident response process with defined SLAs for acknowledgment and resolution.

Reporting a vulnerability

Security researchers and customers can report vulnerabilities to dev@remlabs.ai. We commit to acknowledging all reports within 24 hours and providing a resolution timeline within 72 hours.

Backup and Disaster Recovery

Network and Application Security

The API implements multiple layers of network and application-level protections.

• SSRF protection: Server-Side Request Forgery protection with private IP and hostname blocking. All outbound requests (when applicable) are validated against an allowlist.
• DNS rebinding protection: Request host headers are validated to prevent DNS rebinding attacks.
• Rate limiting: Per-tier rate limits with standard HTTP headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset). Prevents abuse and ensures fair usage.
• Request size limits: Maximum payload sizes enforced to prevent denial-of-service via oversized requests.
• Timeout protection: Request timeouts prevent slow-loris and connection exhaustion attacks.
• Prototype pollution protection: Input validation prevents JavaScript prototype pollution attacks on JSON payloads.
• Security headers: All responses include HSTS, Content-Security-Policy, Cross-Origin-Resource-Policy, X-Content-Type-Options, and X-Frame-Options headers.
• Dependency scanning: Automated dependency vulnerability scanning with alerts on critical CVEs.

Penetration Testing

REM Labs conducts regular security assessments to identify and remediate vulnerabilities.

• External penetration test: Scheduled for Q3 2026 with an independent third-party security firm. Results and remediation report will be available to Enterprise customers under NDA.
• Continuous scanning: Automated vulnerability scanning runs on every deployment to catch regressions.
• Bug bounty: Responsible disclosure process in place. Researchers can report vulnerabilities to dev@remlabs.ai.

Compliance Roadmap

REM Labs is actively pursuing industry-standard compliance certifications.

Summary of Controls

The following table summarizes the key security controls implemented by REM Labs.