AI memory needs a standard. SAIHM already meets it.

1. The AI memory landscape today (honest read)

Four categories of solution dominate. None of the first three was designed to be a standard.

Each of the first three categories ships real value — conversational continuity, hosted convenience, similarity search. None was designed to be the durable, regulator-defensible memory layer your AI agents will be operating in for the next decade. None offers all of: user-held keys, cross-tool portability, cryptographic erasure, and a tamper-evident audit trail. SAIHM does.

2. The consensus requirements an AI memory standard must meet

Ten requirements converge from active regulation, security frameworks, and the AI-tooling open protocols. They are not optional for any organisation already covered by data law.

The sources of the consensus. The list below is the intersection of obligations and norms that practitioners are already operating against:

• GDPR Article 17 — right to erasure, including data held by automated decision systems.
• EU AI Act (Regulation 2024/1689) — logging, traceability, and human-oversight requirements for high-risk AI systems; phased application through 2027.
• NIST AI Risk Management Framework 1.0 (January 2023) — provenance, auditability, and incident-response expectations.
• ISO/IEC 27001:2022 — cryptographic key management, access control, and audit logging controls.
• HIPAA, PIPEDA, PIPL, LGPD — sectoral and regional privacy regimes with similar erasure and audit obligations.
• Model Context Protocol (open spec, multi-vendor adoption) — the de-facto interoperability surface for AI memory tools across Claude, ChatGPT bridges, Cursor, Continue, and custom agents.
• Operational reality — organisations running heterogeneous AI fleets need one memory layer across many clients to avoid an integration-and-audit explosion.

The ten requirements. Any AI memory layer that aspires to be a standard must satisfy all of them:

1. User-held key custody. The encryption key sits with the data subject (or their organisation), not the vendor. Vendors cannot read what they cannot decrypt.
2. Cryptographic erasure with proof. A forget operation destroys the key, leaves the ciphertext mathematically unreadable, and produces an independently verifiable receipt — the GDPR-Article-17-defensible posture.
3. Tamper-evident audit trail. Every write, recall, share, and erasure is logged to a surface neither operator nor user can silently rewrite. This is the regulator-facing artefact.
4. Open standard, cross-tool portability. The same memory protocol works across every AI client an organisation uses, today and after the next vendor change.
5. Encryption at rest and in transit. Ciphertext-only storage; ciphertext-only egress. No plaintext at any node the user does not control.
6. Polymorphous data shapes. Tables, JSON, key-value records, prose, transcripts, and binary references in one protocol. Input one shape, request another; the cell does not care.
7. Revocable scope-bound sharing. Per-record sharing with time bounds, mode bounds, and one-prompt revocation. No blanket access.
8. Distributed-agent coordination. Multiple AI agents — across regions, fleets, or supply chains — can share live memory state with cryptographic access control. Single source of truth without manual sync.
9. One protocol, every client. A single integration surface for the whole AI fleet. Minimises engineering cost, audit cost, and incident-response surface area.
10. Independent verifiability. Open source, public-chain anchors, and reproducible builds. No "trust us" claims; every assertion is testable by a third party.

3. SAIHM, requirement by requirement

SAIHM is the only public AI memory protocol we are aware of that satisfies all ten requirements today. Each line below is independently verifiable.

4. The CISO checklist

Paste this into your next AI memory RFP, regardless of the vendor you are evaluating. Any vendor that scores fewer than 10/10 is a partial solution that will compound audit cost and lock-in risk.

• Can your organisation hold the decryption key, with the vendor unable to decrypt without you?
• Can the vendor produce a cryptographic erasure receipt for a single record, independently verifiable on a public surface?
• Is every read, write, share, and erasure recorded on a tamper-evident audit surface neither the vendor nor the user can silently rewrite?
• Does the same memory protocol run in every AI client your teams use today and the one they will pick next year?
• Is all data encrypted at rest and in transit, with no plaintext outside your control?
• Can a single memory cell hold structured and unstructured data, and serve it back in either shape on demand?
• Can you grant scope-bound, time-bound, revocable access on a per-record basis from a single prompt?
• Can a fleet of AI agents share live memory state with cryptographic access control, without manual sync?
• Is the integration surface a single protocol across the whole AI fleet, not a per-tool integration?
• Is the implementation open source, with public-chain build anchors and a third-party-runnable test suite?

SAIHM answers yes to all ten. The honest result of running this checklist across the rest of the market today: vendor-native scores 0–2, hosted SaaS scores 2–4, self-operated vector DBs score 3–5 (everything you build yourself). The 4–7 point gap is your audit cost, your lock-in risk, and your incident-response surface area.

5. Two SAIHM operations a CISO will care about on day one

These are the two prompts your team can run within the first hour of adopting SAIHM. Both are paste-ready into any MCP-capable AI client.

The audit-trail export

Use SAIHM to export the audit trail for the
{department-or-system} workload, last 90 days.
Format as a CSV suitable for the risk committee.

You get a tamper-evident, public-chain-anchored record of every memory operation your AI agents ran in the period. Bring it to the next risk meeting. Most incumbent memory vendors cannot produce this artefact at all; SAIHM produces it by default.

The verifiable erasure

Use SAIHM to forget all cells tagged
{data-subject-id}. Produce the destruction receipt
and the public-chain anchor for legal review.

This is your GDPR-Article-17-defensible posture in one prompt. The cell's encryption key is destroyed; the ciphertext is mathematically unreadable; the destruction event is anchored on a public chain. Counsel can verify the receipt independently.

6. Adopting SAIHM as your AI memory standard

1. Join SAIHM at /join. Five-step quickstart (wallet, USDC.e, connect, say "Join SAIHM", verify). PAYG and paid tiers available; see /pricing.
2. Run an audit-trail export on a small SAIHM workload within the first hour. Present the artefact at your next risk meeting.
3. Run the CISO checklist on your incumbent memory tool side-by-side with SAIHM. The standard wins on paper before it wins in production.
4. Scale. Recommended pattern for multi-agent deployments: one fresh empty wallet per AI Agent (memories are bound to the wallet that wrote them; per-agent wallets contain blast radius and produce per-agent audit trails). Setup guide on the quickstart.

SAIHM does more than every alternative and asks less of the organisation. One protocol. User-held keys. Cryptographic erasure with public-chain proof. The CISO checklist passes; the CFO benefits from the 80 percent reduction in token spend and roughly 5x productivity lift on the same workloads.

Join SAIHM

Still have questions? The SAIHM chatbot at the bottom-right of this page answers immediately — including regulatory citations, architecture details, and pricing comparisons. Ask before you talk to your team.