Memory your agents can use —
and no one else can read.

VaultZero is a privacy-first memory vault. It stores only client-encrypted ciphertext and vector embeddings; plaintext and keys never reach the server. Retrieval is pgvector cosine similarity over a tenant-scoped, filtered subset.

See how it works Read the source

On your device plaintext lives here

from vaultzero.client import Vault

vault = Vault("https://api.vaultzero.cc", credential)

# embed + encrypt locally
vault.memory.write("Meeting with Acme next Tuesday.")

# recall by meaning, decrypt the envelope
hits = vault.memory.search("when is the Acme meeting?")
print(hits[0].text)

On the server ciphertext only

-- what VaultZero actually stores
SELECT id, tenant_id, kind,
       ciphertext,          -- opaque bytes
       embedding <-> query  -- cosine distance
FROM memories
WHERE tenant_id = 'aa810f05…'
  AND scope = ANY($scopes)
ORDER BY 4
LIMIT 10;

What it does

Encrypted at rest

The server stores ciphertext envelopes and vector embeddings. It never imports client crypto, so a database compromise yields nothing readable.

Retrieved by meaning

pgvector cosine similarity finds related memories across a filtered, tenant-scoped subset — no keyword matching required.

Scoped to a tenant

Row-level security and least-privilege database roles isolate every tenant, subject, and principal from the query planner outward.

Billed, not spied on

Usage is metered per tenant against a durable ledger — reconciliation and billing run without the server reading your plaintext.

How it works

1

Embed and encrypt on the client

The trusted client embeds plaintext into a vector and encrypts the text with keys that never leave your device. It sends only the ciphertext and the vector.
2

Store ciphertext and vectors

The API authenticates the credential, enforces authorization and row-level security, and persists the ciphertext envelope alongside its embedding — under a tenant-scoped database role.
3

Recall by similarity

A query vector is compared against the tenant's filtered subset with pgvector cosine similarity. Matching envelopes come back still encrypted.
4

Decrypt on the client

Only the client holds the keys, verifies AAD and context integrity, and decrypts. Plaintext appears on your device alone.

Trust model

VaultZero is built so the server never needs your plaintext to do its job.

Client is the only reader

The client is the only code that embeds, encrypts, and decrypts. The server and jobs operate entirely on ciphertext, vectors, and metadata.

Keys stay with you

Payload keys and embedding providers live in the trusted client. Credentials are verified via a constant-time HMAC keyed by a separately protected pepper.

Row-level security

Every tenant-scoped write sets app.tenant_id inside a transaction; PostgreSQL policies and least-privilege roles do the rest.

Erasure that survives restore

A restore-independent erasure journal replays deletes after any database restore, so a purged subject stays purged.

SDK & MCP

A Python client, an MCP host for agents, and a server you can run yourself.

Drop-in memory for your agents

Run the MCP host as the trusted process that holds keys and sees plaintext. Point your agent at it and every memory is encrypted before it leaves the machine.

Client-side embedding and encryption
Tenant-scoped pgvector retrieval
Per-principal scopes and actions
TTL expiration and purge state machine

Read the README

MCP host

# the trusted process that holds keys
export VZ_BASE_URL=https://api.vaultzero.cc
export VZ_CREDENTIAL=<secret>
export VZ_KEY_STORE_PATH=~/.vaultzero/keys.json

vaultzero-mcp

Keep your agents' memory yours.

Encrypted at rest, scoped by tenant, retrieved by meaning.

Star it on GitHub How it works

Memory your agents can use —and no one else can read.