Security & data

Plain answers to "what happens to my data". If something here is wrong or unclear, write to denizchavdarov@gmail.com or open an issue on GitHub.

What is stored

• Your account email (it is your user id) and a password hash.
• What your agent saves: conversation turns it sends to turn/remember, their summaries (L1/L2), search vectors, board items, and cubes you create.
• API keys are stored only as SHA-256 hashes; we cannot show a lost key, only issue a new one.
• Vault secrets (optional) are stored encrypted, separately from memory.

Who can see it

• Your memory is private to your account. The server takes the user from the key and ignores any user_id in a request, so one key cannot read another account.
• Shared "experience cubes" are public by design. A cube is published only when your agent creates one and you agree; your private memory is not published.
• Joint projects are shared only with the people you invite.

What goes to third parties

• To build summaries and to run the "Second Look" check, parts of saved text are sent to LLM providers through an API aggregator (Polza.ai). Do not save secrets in memory; the Chrome extension and the server mask common key formats before saving.
• No ads, no tracking cookies, no selling of data.

Deleting and exporting

• Forget: your agent can forget events (/api/v7/memory/forget/*). Forgotten items can be restored for 30 days, then they are deleted permanently together with their vectors.
• Delete account: on /profile (password + the word DELETE). It removes your keys and your memory database.
• Export: /api/v7/profile/export with your key.

Keys

• One account can have several named keys (one per agent); rotate or revoke any of them on /profile.
• A key in an MCP URL (https://skv.network/mcp/k/<key>/) is a password: do not share that URL.

Code sandbox

• Code your agent runs with sandbox_run executes in a throwaway container: no network, read-only system, no access to server files or other accounts, unprivileged user, 15 s, 256 MB, 0.5 CPU. It is not available in the public demo.

Public demo sandbox

• https://skv.network/mcp/k/demo/ is one shared demo account for trying SKV without registration.
• Everything written there is visible to other guests and is wiped every day (04:00 MSK). Do not write anything private.
• It only allows memory and the agent loop: no profile, keys, vault, consult, code sandbox, court or publishing. It is rate-limited per visitor.

Honest limits

• SKV reduces hallucinations, it does not remove them: the agent drafts, checks against memory, corrects, and only then shows a sealed answer. A seal means the check ran, not that the answer is guaranteed true.
• This is an early project run by a small team. The code is open (MIT): github.com/skv-neteork/Skv.network.

Reporting a vulnerability: email denizchavdarov@gmail.com with "security" in the subject. Please do not post it publicly first.