Security
A memory system holds decisions, not just notes — so access and provenance matter. jMemoria is secure by default and built on the same security base as jCustos.
Bearer tokens
Per-workspace authz
Membership as history
Localhost-only without tokens
- Authentication Bearer tokens on REST and MCP. The token file stores only SHA-256 hashes, compared in constant time; the token decides both identity and actor type.
- Safe default binding
Without a token file the REST server binds to
127.0.0.1only — it is never exposed by accident. - Per-workspace authorization
Authorization for reads and writes, per workspace (owner or member). A refusal is indistinguishable from "does not exist" (
404), so access itself leaks nothing. - Membership as a commit Granting and revoking workspace access are themselves commits — who gave whom access, and when, is part of the history.
- Secure by default Without trusted principals, writes are refused. Nothing is open until you configure it.
- jCustos security base Identity integrates through a provider port, backed by jCustos. UI sign-in is per browser session.
jMemoria records what auditors typically ask for — who changed what,
when, as a person or as an AI. It makes no legal-compliance claims;
what it offers is a traceable, reproducible history you can inspect.