A second brain only works if you actually trust it with your second thoughts. The half-finished ideas. The doubts. The things you wouldn't post anywhere public. The notes you wouldn't want anyone to read.
So let's be specific about how Eigen Mesh keeps your memory yours — including, where possible, keeping it private from us.
The principle
Your memory belongs to you. We're the operator of the managed service, not the audience for your thoughts. Every design decision follows from that.
Concretely, that means four things:
- We don't train on your data.
- Your memories are encrypted at rest.
- Your memories are isolated per user.
- Your data lives on EU servers under GDPR, and you can leave with it.
Let's take them one at a time.
1. We don't train on your data
This is the big one, so let's be unambiguous: we do not use your captures, your enrichment results, your retrievals, or any other content of your memory to train models. Not ours, not anyone else's.
A lot of AI companies have terms that allow them to use your inputs for training "to improve the service." We don't. Your thoughts are not a training set. They're a product we sell to one person — you.
Because Eigen Mesh is open source under Apache 2.0, this isn't a promise you have to take on faith. The code that handles your captures is the code on GitHub. If we ever changed this policy, you'd see it in the repo.
2. Encrypted at rest
When your memories are stored, they're encrypted. Not just the database as a whole — individual records are encrypted, so even someone with database access can't simply read your thoughts as plain text.
This matters because the obvious attack on any "AI memory" product is the database. If a memory service stores your raw thoughts unencrypted, then any database breach is a full breach of every user's inner life. We didn't want that to be possible, so we don't store them that way.
Encryption at rest doesn't make a service unhackable — nothing does — but it changes the threat model. A leak of the database doesn't automatically become a leak of the contents.
3. Isolated per user
Your memories are yours, and only yours. Eigen Mesh enforces row-level isolation, which is a technical way of saying: the system that stores your thoughts is structured so that one user can never read another user's data, even on the shared managed service.
This isn't a policy we enforce at the UI layer. It's enforced at the data layer, so it can't be bypassed by a buggy frontend or a clever query. The database itself won't return another user's rows to your account.
Why does this matter? Because most "AI tools" that share infrastructure route every user's data through the same model context, and leakage is a real, demonstrated problem. We didn't want the architecture to make leakage possible, so the architecture doesn't.
4. EU servers, GDPR, and you can leave
Eigen Mesh's managed service is hosted on servers in the European Union, under the GDPR. That means:
- Your data is covered by EU data protection law, which is (currently) some of the strongest in the world.
- You have the right to access what we hold about you.
- You have the right to delete it.
- You have the right to export it and leave.
We don't make leaving hard. There's no "we'll get back to you within 30 days" friction. Your memory is yours to take with you — and because Eigen Mesh is open source, you can run the same software yourself after you leave.
The option behind all of this: self-host
If even the above isn't enough — and for some people, reasonably, it isn't — the entire Eigen Mesh stack is self-hostable. Same software, your hardware, your network, your rules.
When you self-host:
- Your captures never leave your machines.
- We don't see them. We can't see them.
- You apply your own encryption, your own access controls, your own backups.
- You're the operator. We're just the upstream project.
For security teams, for people working under NDA, for anyone who simply doesn't want a third party in the loop on their own thinking — self-hosting is the answer. The repo is at github.com/hikaru90/eigen, and the docs walk you through it.
What this doesn't cover
We should be honest about the limits.
- We can't protect you from your own machine being compromised. If malware on your laptop reads your session, encryption at rest on our side doesn't help.
- We can't protect you from a sufficiently determined attacker who gets your account credentials. Use a password manager and turn on second-factor auth.
- No system is perfectly secure. We've made the standard, sensible choices — encryption at rest, isolation per user, EU hosting, no training on data — and we've made the source code public so you can check our work. We haven't made impossible promises.
What we have done is remove the easy, common ways AI memory products go wrong. Your data isn't a training set. Your data isn't shared across users. Your data is encrypted, hosted in the EU, and exportable on demand. And if you want to remove us from the equation entirely, you can.
The shorter version
Your memory. Not theirs. Including, as much as we can manage, not ours.
Try it
If privacy is the thing that's been holding you back from a second brain, get early access and try the managed version with 100 free credits. Or clone the repo and run it yourself. Either way, your thoughts stay your thoughts.