VaultZero

Memory your agents can use —
and no one else can read.

VaultZero is a privacy-first memory vault. It stores only client-encrypted ciphertext and vector embeddings; plaintext and keys never reach the server. Retrieval is pgvector cosine similarity over a tenant-scoped, filtered subset.

See how it works Get a credential
On your device plaintext lives here
from vaultzero.client import Vault

vault = Vault("https://api.vaultzero.cc", credential)

# embed + encrypt locally
vault.memory.write("Meeting with Acme next Tuesday.")

# recall by meaning, decrypt the envelope
hits = vault.memory.search("when is the Acme meeting?")
print(hits[0].text)
On the server ciphertext only
-- what VaultZero actually stores
SELECT id, tenant_id, kind,
       ciphertext,          -- opaque bytes
       embedding <-> query  -- cosine distance
FROM memories
WHERE tenant_id = 'aa810f05…'
  AND scope = ANY($scopes)
ORDER BY 4
LIMIT 10;

What it does

Encrypted at rest

The server stores ciphertext envelopes and vector embeddings. It never imports client crypto, so a database compromise yields nothing readable.

Retrieved by meaning

pgvector cosine similarity finds related memories across a filtered, tenant-scoped subset — no keyword matching required.

Scoped to a tenant

Row-level security and least-privilege database roles isolate every tenant, subject, and principal from the query planner outward.

Billed, not spied on

Usage is metered per tenant against a durable ledger — reconciliation and billing run without the server reading your plaintext.

How it works

  1. 1

    Embed and encrypt on the client

    The trusted client embeds plaintext into a vector and encrypts the text with keys that never leave your device. It sends only the ciphertext and the vector.

  2. 2

    Store ciphertext and vectors

    The API authenticates the credential, enforces authorization and row-level security, and persists the ciphertext envelope alongside its embedding — under a tenant-scoped database role.

  3. 3

    Recall by similarity

    A query vector is compared against the tenant's filtered subset with pgvector cosine similarity. Matching envelopes come back still encrypted.

  4. 4

    Decrypt on the client

    Only the client holds the keys, verifies AAD and context integrity, and decrypts. Plaintext appears on your device alone.

Trust model

VaultZero is built so the server never needs your plaintext to do its job.

Client is the only reader

The client is the only code that embeds, encrypts, and decrypts. The server and jobs operate entirely on ciphertext, vectors, and metadata.

Keys stay with you

Payload keys and embedding providers live in the trusted client. Credentials are verified via a constant-time HMAC keyed by a separately protected pepper.

Row-level security

Every tenant-scoped write sets app.tenant_id inside a transaction; PostgreSQL policies and least-privilege roles do the rest.

Erasure that survives restore

A restore-independent erasure journal replays deletes after any database restore, so a purged subject stays purged.

SDK & MCP

A Python client, an MCP host for agents, and a server you can run yourself.

Drop-in memory for your agents

Run the MCP host as the trusted process that holds keys and sees plaintext. Point your agent at it and every memory is encrypted before it leaves the machine.

  • Client-side embedding and encryption
  • Tenant-scoped pgvector retrieval
  • Per-principal scopes and actions
  • TTL expiration and purge state machine
Get a credential
Install private index
# one-time: sign in and add the private-index helper
gcloud auth login
pip install keyrings.google-artifactregistry-auth

# install the SDK + MCP host
pip install "vaultzero[client]" \
  --extra-index-url \
  https://europe-west2-python.pkg.dev/vaultzero-512412/vaultzero-python/simple/
MCP host
# the trusted process that holds keys
export VZ_BASE_URL=https://api.vaultzero.cc
export VZ_CREDENTIAL=<secret>
export VZ_KEY_STORE_PATH=~/.vaultzero/keys.json

vaultzero-mcp

Get a credential

Every API call authenticates with a per-tenant, per-principal credential. Credentials are issued by VaultZero — provisioning is manual today, so you'll receive one over a secure channel rather than generating it yourself.

  1. 1

    Request access

    Email us with the scopes you need (preferences, work, …) and whether you'll call from the Python SDK or the MCP host. We provision a tenant, embedding space, subject, and principal scoped to exactly those permissions.

  2. 2

    Receive your secret

    Your credential is a 64-hex-character bearer secret. It's shown exactly once and delivered over an encrypted channel (Secret Manager or a password manager) — never written to logs. Treat it like a password.

  3. 3

    Keep it on the trusted client

    The credential and your payload keys belong only on the machine running the client or MCP host. The server stores a keyed verifier, so it can authenticate you without ever holding the secret.

  4. 4

    Use it

    Pass the credential to the Python SDK, or export it as VZ_CREDENTIAL for the MCP host. Rotate by requesting a fresh credential; revoke instantly if one leaks.

Python SDK

Embedding and encryption stay on your machine; only ciphertext and vectors are sent.

  • Credential is a bearer secret — never commit it
  • Client-side embedding provider you control
  • Rotate and revoke without re-provisioning data
Python
from vaultzero.client import VaultZeroClient

client = VaultZeroClient(
    base_url="https://api.vaultzero.cc",
    credential="<your-64-hex-secret>",
    embedding_provider=provider,
)

await client.remember_fact("Meeting with Acme next Tuesday.", scope="work")
hits = await client.recall_context("when is the Acme meeting?", scopes=["work"])

Keep your agents' memory yours.

Encrypted at rest, scoped by tenant, retrieved by meaning.

Request access How credentials work