Trust & Security
What we can prove, and what we can’t yet.
Starling MX is an AI chief of staff that works from a memory you own. This page says where that memory lives, what the AI sees, who holds the keys, and which of our claims rest on how Starling is built and which rest on a provider’s promise.
Last updated October 2026 · Starling Memory Works, Inc. · Available in the United States only
The short version
- Your memory lives outside the model, in a repository you choose: your own Notion, a Nest we host for you, or, for Enterprise, a Nest in your own AWS.
- We never train on it. There is no training pipeline in our software.
- When the AI works, it gets only what the question needs, checked against your permissions, never the whole library, and it forgets when the task ends.
- What the model provider sees at that moment is covered by its no-training, bounded-retention terms. That’s the provider’s promise, and we call it one.
- You can export everything, at any time, as plain text.
- We hold no security certification today, and we’ll say so when we do.
Where your memory lives
You choose the repository when you set up your organization.
| Option | Where it lives | Who holds the key |
|---|---|---|
| Your Notion | Where it livesYour own workspace, under your Notion account | Who holds the keyNotion’s security applies. You can revoke our access in Notion at any time, and it ends at once. |
| A Nest, managed on Starling MX | Where it livesOur Amazon Web Services account, in the United States | Who holds the keyWe manage the key, with a recovery copy in escrow outside the server it runs on. |
| A Nest in your own AWS (Enterprise) | Where it livesYour cloud account, with Starling OS running there under license | Who holds the keyOnly you. |
A Nest is the repository we built for organizational memory: plain text, at permanent addresses, encrypted at rest. Whichever you choose, you can export the whole library at any time as an archive encrypted with a passphrase you set. It opens to plain text without a Starling account.
What the AI sees
We don’t run the models ourselves. When the AI works, the context assembled for that question is sent to the model provider, so we never say your data doesn’t reach the provider. It does, one question’s context at a time. Here is what we guarantee, and what we rely on the provider for.
Guaranteed by how Starling is built
- Your memory lives outside the model and is never stored in it.
- Starling never trains on it; there is no training pipeline in our software.
- Each request carries only what the task needs, checked against the asker’s permissions, never the whole library.
- Every call is stateless: the model forgets when the task ends.
- A person, not the model, approves what goes back into the library.
- You can export everything, at any time.
Backed by the provider’s terms
- The provider doesn’t train on what it’s sent.
- Anthropic and OpenAI may keep inputs and outputs for up to 30 days for abuse monitoring, and Google for up to 55 days, then delete them. Certain Anthropic models carry 30-day retention on every plan.
- We check these terms against what each provider publishes.
The architecture is the guarantee for what’s yours. The provider’s terms are the backstop for what the model sees.
Encryption and keys
Data is encrypted in transit and at rest, and we encrypt sensitive credentials such as your Notion authorization token.
In a Nest, content is encrypted with a key unique to your organization. Every paragraph of every document, and every attached file, is encrypted with AES-256-GCM, the standard used for classified government data. Your organization’s key is itself locked by a master key we hold.
Some things stay readable, on purpose. Document titles, their addresses, filenames and the record of who changed what and when are not encrypted, so search stays fast. Someone who stole a Nest archive without the key could see how your library is organized and what each document is called. They couldn’t read a word of the content.
Who holds the key. For a managed Nest, we do. A complete recovery copy sits in escrow outside the server, where it can be deposited but not withdrawn, and we’ve restored a complete test library from escrow alone. For a Nest in your own AWS, only you hold the key. Customer-managed keys (AWS KMS) for managed Nests are a paid option, coming.
Isolation and backups
- One organization, one database. Each organization’s Nest is a separate database file. There’s no shared table where one missing filter could expose one customer’s memory to another.
- Your User Library is yours alone. Personal working notes are never loaded into anyone else’s session, including an Owner’s.
- The repository checks its own permissions. Who may change what is decided by each document’s address and rechecked by the repository itself, not taken on trust from the request. Canon changes only through approval.
- No open door. The repository engine accepts no direct connections from the internet.
- Backups an intruder can’t erase. Backups are encrypted, and the server that writes them can neither read them back nor delete them.
What we log, and for how long
- Usage records: tokens used, model chosen and request counts, so we can bill accurately and show you where your usage went.
- Server logs: IP address, browser and device information, kept for security and debugging. We don’t currently commit to a fixed retention period.
- Voice: your audio streams from your browser to OpenAI for transcription. We don’t store the audio.
- Ask Starling, on this site: we store neither your question nor the audio, and it never reaches any customer’s memory.
- When you delete your organization, we delete everything at once: account, sessions and chat history, the memory index, generated documents, uploads, usage records, and our event and audit logs. If your memory is in a Nest, export it before you delete your organization. Billing records are kept as long as tax law requires.
Who processes your data
We don’t sell or rent your data. These providers help us run Starling, each bound by contract.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic | What it doesAI processing (Claude), our primary provider | What it receivesThe context for each request; files Studio converts |
| OpenAI | What it doesFallback text generation, and realtime voice | What it receivesThe context for each request; voice audio |
| What it doesAI processing (Gemini), when your organization selects it | What it receivesThe context for each request | |
| Amazon Web Services | What it doesHosting for managed Nests, in the United States | What it receivesYour memory, encrypted |
| Supabase | What it doesOperational data | What it receivesSessions, the memory index, generated documents |
| Cloudflare | What it doesSecure connection to the repository engine | What it receivesEncrypted traffic in transit |
| Vercel | What it doesApplication hosting | What it receivesTraffic to the app and this site |
| Notion | What it doesYour memory, if you choose Notion | What it receivesYour memory, in your own workspace |
| Google Drive, OneDrive, Dropbox | What it doesStudio import and export, when you connect them | What it receivesThe files you choose |
| Firecrawl | What it doesReading a website, when you ask Starling to | What it receivesThe web address you give it |
| Stripe | What it doesPayments | What it receivesPayment details; we see only the last four digits |
| Resend | What it doesTransactional email | What it receivesYour email address and the message |
Document rendering and conversion run on our own OnlyOffice server, not a third party’s.
Certifications
We’re in beta, and we won’t overstate our security posture. We hold no security certification today and will state one only once we have it. We’ve begun SOC 2 readiness, scoped to Security and Confidentiality, and will publish a target date once an auditor is engaged. If certification is a requirement for you, talk to us before relying on Starling for sensitive material.
Starling and Verified ZDR
Verified ZDR is the standard we’ve proposed for the AI labs: an independent auditor confirms that a lab doesn’t train on customer content, keeps nothing beyond published exceptions, and that turning memory off means off. It’s a standard for model providers. Starling isn’t one, so we don’t claim it.
What we do instead: we build so that, in conversation, the only thing any provider can keep is one question’s context, never your library, and we publish each provider’s retention window on this page. When Studio converts a document, the file is uploaded to Anthropic, which may keep it for up to 30 days. When a provider meets Verified ZDR, we’ll say so here. Read the proposal in the Sovereign Memory Initiative →
Report a security issue
If you find a vulnerability, email security@starlingmx.com. If we discover a breach affecting your personal data, we’ll notify you and any regulator without unreasonable delay, as applicable law requires.
Smaller team? See pricing →