Safety Pii And Governance

A user pastes a full credit-card number and SSN into a chat; the agent add()s the turn with infer=True.

Minimize sensitive data at the boundary: redact or avoid storing raw secrets (card numbers, SSNs, passwords) before/while adding, and constrain extraction (custom prompt) so identifiers are not persisted as memories. Storing raw secrets creates a durable breach surface.

An EU customer requires memories to stay in-region and chooses OSS Mem0 backed by an EU-hosted vector store and LLM.

Use self-hosted OSS (or a Platform region option if offered) so the vector store, embedder, and extraction LLM all run in the required region, keeping memory data in-region. Verify each backend's location; do not route extraction through an out-of-region model. [REQUIRES-VERIFICATION] for Platform …

An auditor asks who/what changed a user's stored facts and when, for a regulated deployment.

Use memory history (per-memory change log) plus operator-side access logging to produce an audit trail of add/update/delete and reads. Persist actor + timestamp context the Mem0 history alone may not capture. Do not rely on reconstructing changes after the fact.