Security by architecture,
not policy.

If you discover a security vulnerability in VEKTOR Memory or the Slipstream SDK, please report it to [email protected]. We ask that you give us 90 days to remediate before public disclosure.

We will acknowledge your report within 48 hours, provide an initial assessment within 7 days, and keep you updated on remediation progress. We don't currently offer a formal bug bounty, but we recognise researchers who report valid findings in our release notes.

P0 — Critical: Active exploitation, credential exposure, or data breach. Response begins within 1 hour. All production access locked down immediately.

P1 — High: Unpatched high-severity CVE in a shipped dependency, or authentication bypass. Response within 24 hours.

P2 — Medium: Confirmed vulnerability without known exploit. Patched in next planned release within 30 days.

P3 — Low: Informational findings, hardening opportunities. Addressed in quarterly review cycle.

Because VEKTOR is local-first with zero cloud memory storage, a compromise of Vektor's own infrastructure cannot expose your memory corpus. The worst case for a Vektor server breach is: exposure of your licence email address and activation timestamp. That's the only data we hold.

Your memories, embeddings, and agent context live entirely on your own infrastructure. They are not reachable from ours.

In the event of a confirmed security incident affecting customer data (i.e., licence account information), we will notify affected customers via their registered email within 72 hours of confirmation, consistent with GDPR Article 33 timelines even where not legally required.

Notifications will include: nature of the incident, data categories affected, steps we've taken, and recommended actions for customers.

No. Your memories are stored in a SQLite database on your machine or server. Vektor has no network path to that database. We physically cannot read your memories — not by policy, but by architecture.

Your memories remain on your machine and are fully accessible without an active licence — the local SQLite database doesn't have a kill switch. You retain ownership of your data regardless of subscription status. The only thing that stops working is the licence validation, which disables the SDK's LLM routing features.

For the data we hold (licence email, activation timestamp): yes. We process this data on the legal basis of contract performance. You can request deletion at any time by emailing [email protected] — we will purge your licence record within 30 days, after which your licence key will cease to function.

For your agent memories: GDPR doesn't apply to data we never see. That data is entirely under your control and jurisdiction.

Partially. The memory layer, embedding computation, and MAGMA graph operations work fully offline. Licence activation requires a one-time internet connection. After initial activation, offline operation is supported for the memory functions. LLM provider calls obviously require connectivity to your provider, but that's outside VEKTOR's scope.

We are currently preparing for SOC 2 Type I. We expect to complete the audit in Q3 2026, with Type II observation beginning immediately after. In the meantime, our local-first architecture provides stronger practical security guarantees than a SOC 2 badge on a cloud product — there is no centralised Vektor data store to audit in the first place.

If you have an enterprise procurement requirement for SOC 2 today, contact [email protected] — we can share our in-progress controls documentation and security architecture detail under NDA.

Production access is key-only SSH — no passwords. All API keys and credentials are stored in the cloak_passport encrypted vault, never in plaintext config files or environment files committed to source control. Internal systems use unique credentials per service with no shared passwords.