What we store, where it lives, and how you get it back.

The short version

• Your content is never used to train models. Not ours, not anyone's.
• We never see your source code. No repository access, no indexing. Only the notes your agent writes.
• Every query is workspace-scoped from server-derived identity, so tenants cannot reach each other's data.
• You can export everything as markdown, on any plan, at any time.
• Deletion is real and cascades to every dependent record.

What is stored

What is not stored: your source code, your repository, your git history, or anything your agent doesn't explicitly send.

Isolation between workspaces

This is the invariant everything else rests on. Every notes, keys, members and sessions query filters by a workspace id that comes from the server-side session or API-key lookup — never from a field the client supplies. There is no code path that takes a caller-supplied workspace identifier and trusts it. Caller-supplied values that reach a database filter are string-coerced first, so a value shaped like a query operator is treated as a literal rather than an operator.

Access to the endpoints themselves follows the same principle. The MCP endpoint accepts API keys and OAuth tokens only. Administrative actions require a browser session, so an API key can never create or revoke another key. OAuth tokens work only on /mcp, never on the wider API.

Authentication

Scoping what an agent can reach

An MCP credential does not have to have full workspace access. When you create a key you can make it:

• Read-only — every write tool is refused with a clear error rather than a silent no-op.
• Project-scoped — restricted to a single project. Notes elsewhere aren't refused, they're invisible: reads behave as if they don't exist, matching the workspace-isolation convention. Workspace-wide structural tools are blocked outright for a scoped key.
• Expiring — set a lifetime in days at creation.

This is what makes it reasonable to hand a client-project agent a credential: it cannot read another client's notes even if it tries.

Sharing, deliberately

A note can be given a read-only share link on Team and Business plans, viewable without an account by anyone holding the unguessable token. It is off by default, per note, idempotent to enable, and revoking it 404s the old link immediately. Shared pages are served with X-Robots-Tag: noindex, nofollow and excluded in robots.txt — the token is the access control, but there's no reason to make it discoverable as well.

Export, backup and deletion

• Export. A full ZIP of your workspace as markdown files, from Settings, on any plan. Your project memory should be portable, and it is.
• Agent-side export. backup_project returns one project's full content inline for your agent to persist wherever you like.
• Trash. Deleting a note is a soft delete; it stays restorable until purged.
• Account and workspace deletion. Removes every dependent record — notes, revisions, tokens, audit entries, keys, sessions, memberships, subscriptions — explicitly, not just the parent row.

Infrastructure and operations

• All traffic is served over TLS; the application binds to loopback behind a reverse proxy that accepts traffic only from the CDN's published networks.
• A strict Content-Security-Policy is in force on every page; the site carries no inline scripts at all.
• Bot protection on public forms via Cloudflare Turnstile; rate limits on authentication, contact and API surfaces.
• Outbound webhook destinations are validated against private and loopback address ranges on every delivery, not just at registration, so a webhook cannot be used to reach internal services.
• Backups run on a schedule, and a restore is verified regularly into a throwaway database rather than assumed to work.
• Payments are processed by Paddle as merchant of record. Card details never touch our infrastructure.

Cookies and analytics

Analytics, session replay and live chat all set cookies, so none of them load until you accept on the consent banner. Decline and nothing is set beyond the strictly-necessary session cookie and bot protection. You can change that decision at any time from the privacy page. The one always-on measurement tag is cookieless by design.

Reporting a vulnerability

If you find a security issue, email hello@knownbase.dev with enough detail to reproduce it. We'd rather hear about it early and quietly than late and publicly, and we'll confirm receipt.

FAQ

Is my content used to train AI models?

No. Your notes are never used to train models, ours or anyone else's, and they are not shared with third parties for that purpose. Knownbase stores and retrieves what your agents write; it does not learn from it.

Who can read my notes?

You and the members you invite to your workspace. Every query in the application is scoped by workspace id derived from the server-side session or API key — never from anything the client sends — so one tenant's notes cannot be reached from another's credential. The one exception you control is a share link, which you create per note and can revoke.

Does Knownbase read my source code?

No. There is no repository access, no indexing, and no agent-side crawler. Knownbase only ever sees what your agent explicitly sends as a note. If your agent doesn't write it, we don't have it.

Can I restrict what an agent can reach?

Yes. An API key can be marked read-only (queries only, all write tools refused), scoped to a single project (notes in every other project are invisible to it, not merely refused), given an expiry date, and revoked individually without disturbing your other keys.

How do I get my data out?

Export the whole workspace as a ZIP of markdown files from Settings at any time, or have an agent call backup_project for a single project's full content. There is no export tier and no waiting period.

What happens when I delete something?

Deleting a note moves it to trash, where you can restore it; purging removes it permanently. Deleting a workspace or an account removes every dependent record — notes, revisions, keys, sessions, memberships, audit entries — not just the top-level row.

Where is the data hosted?

In MongoDB on infrastructure operated by ZsTechLabs, reached only over the application's own authenticated API. The database is not exposed to the public internet.