We build memory infrastructure. Trust is the product.
Memory infrastructure that can't be trusted is worse than no memory at all. This page documents exactly what PayQIA guarantees, what is in progress, and what it does not yet claim.
Transparency policyCompliance certifications and security claims are labeled by their current status — not the status we aim for. A claim marked "in progress" is not complete. We will not represent it as complete until it is.
Zero-Knowledge Encryption
PayQIA — built on QIA — is designed so that the infrastructure cannot read your stored data. Your memory contents are encrypted client-side before transmission, and the server holds only ciphertext it cannot decrypt.
What it means in practice
Even if PayQIA's servers were fully compromised, an attacker would find only encrypted blobs with no access to the encryption keys. Your agent's memory contents remain private.
What it does NOT cover
Zero-knowledge applies to stored memory payloads. API calls, query parameters, and metadata may still be logged for billing and abuse prevention — this is disclosed in the Privacy Policy.
Data Retention & Deletion
You own your data. Every memory, session, and user profile stored in QIA can be deleted — individually or in bulk — via the SDK or REST API. Deletion is permanent and not recoverable.
Right to be forgotten
Developers can call memory.delete() or profile.delete() at any time. QIA's smart decay models also prune stale memories on a configurable schedule — but explicit deletion is always immediate and complete.
Retention defaults
By default, memories persist indefinitely until deleted. Developers can configure per-tenant or per-user retention windows in the PayQIA console.
Compliance Roadmap
We are transparent about our compliance status. Certifications take time to earn honestly — we list each initiative with its current state rather than claiming completion before it is achieved.
SOC 2 Type II
Currently in progress. We are in active preparation with a third-party auditor. Target completion is 2025. We will publish the report publicly when complete.
GDPR
PayQIA's data handling architecture is designed for GDPR alignment — data residency controls, deletion APIs, and data processing agreements available for EU customers. Not yet independently audited.
HIPAA / Finance / Government
For regulated industry deployments, we offer on-premises and BYOC (Bring Your Own Cloud) modes that keep data entirely within your own infrastructure. Contact us to discuss your compliance requirements.
Responsible Disclosure Policy
If you believe you have found a security vulnerability in PayQIA, QIA, or any Haqikos infrastructure, please disclose it to us privately. We commit to:
- Acknowledge receipt within 48 hours
- Investigate and respond with our assessment within 10 business days
- Coordinate disclosure timeline with the reporter before going public
- Credit reporters in our security advisories (with permission)
Send security reports to:
security@haqikos.comPlease include a description of the vulnerability, steps to reproduce, and your assessment of its severity.
Deployment Modes for Regulated Industries
On Premises
LiveSelf-host on your own physical infrastructure. Direct control over servers, storage, and networking layers.
BYOC
LiveDeploy inside your own AWS, GCP, or Azure account. Bring Your Own Cloud setup from day one.
Local Workstation
LiveRun the full memory stack locally for offline development, local debugging, or sensitive work.