Local by default.
Honest after release.

What is stored

Compact memory with evidence.

The MVP stores durable content, memory type, scope, source URI, importance, confidence, timestamps, permission grants, and disclosure logs in SQLite.

• Decisions, commitments, facts, preferences, procedures, and events
• Source references such as linear://NIN-42
• Which client received which memory and why

What is rejected

Credentials are not memory.

Ninai rejects common private-key, bearer-token, GitHub-token, and API-key patterns. The hook selects durable outcome fields instead of persisting whole tool responses.

Permission model

One client. Explicit scopes.

A grant applies to a named client and one scope. Access to project memory does not imply access to personal, health, or finance memory. Revocation takes effect on the next recall.

Current limitations

An MVP, not a security certification.

The MVP implements the policy layer. It has not completed the controls required for high-risk production data.

• No SQLCipher or full-database encryption yet
• No signed and notarized desktop package
• No prompt-injection classifier or independent audit
• No cloud sync, account system, or remote relay