Which AI agent memory products support user-held encryption keys?

Of the six reviewed, SAIHM is the only one where the end user holds the key. Pinecone comes closest: CMEK is a customer-controlled key in your own AWS KMS, but it is one key per project, not one per end user. The documentation reviewed for Mem0, Zep, Letta and LangMem does not address key custody.

Can an AI memory product actually satisfy GDPR Article 17?

Deleting a record and making it unrecoverable are different claims. SAIHM destroys the encryption key for that specific cell, so the ciphertext cannot be read by anyone afterwards, including whoever runs the protocol. The other five products reviewed describe record deletion rather than key destruction; Zep’s documentation describes facts being invalidated with a timestamp rather than removed. EDPB Guidelines 5/2019 set the bar at erasure that is verifiable and irreversible. The EDPB has not formally endorsed cryptographic erasure; some data protection authorities accept it.

If I delete a vector, is it gone?

Not reliably. Independent researchers reconstructed soft-deleted embeddings across three HNSW implementations by reading raw index files, recovering 100% of patient age and gender, 99% of facial identity and 25.5% of exact names — see Ghost Vectors. Encrypting each record and discarding the key reduced recovery to zero in the same study.

Is SAIHM a replacement for Pinecone or a vector database?

No. SAIHM is a sovereignty, erasure, audit and sharing layer, not a vector index. It is designed to compose with a vector store underneath it. If your requirement is production-scale vector search and you have no key-custody requirement, use a vector database.

What should I use if I have no regulatory requirements?

Probably not SAIHM. If nobody has to answer for where the memory lives, the products above are each strong within their own positioning, and several are excellent. Work through the agent memory decision matrix first — it will tell you when the right answer is a vector store, or your vendor’s built-in memory, rather than any product on this page.

How current is this page?

Entries were researched on 2026-05-07 and re-verified against current vendor documentation on 2026-08-30. Claims about third-party products go stale; check the vendor source links below before relying on any row. If an entry is wrong, email ops@saihm.coti.global and it is revised on receipt of a canonical source and the page re-dated.

How SAIHM compares to other AI memory products.

Honest comparison vs Mem0, Zep, Letta (formerly MemGPT), LangMem, and Pinecone — across user-held keys, cryptographic erasure, public-chain audit, cross-vendor sharing, and license.

Short answer: across the four properties enterprises audit against — user-held keys, per-memory cryptographic erasure, public-chain audit anchor and cross-vendor consent sharing — SAIHM is the only one of the six products reviewed that addresses all four. Pinecone addresses part of each. The documentation for Mem0, Zep, Letta and LangMem does not address key custody at all.

No strawmen. Where a competitor’s canonical documentation does not address a property SAIHM emphasizes, the table says “not addressed” rather than claiming the absence is a defect.

The five properties SAIHM emphasizes

SAIHM is designed around five emphasized properties; that framing drives the comparison.

User-held encryption keys. The wallet holder, not the operator, is the only party that can read or destroy a memory cell.
Cryptographic erasure. “Forget” destroys the encryption key for that specific memory cell — the data cannot be reconstructed by anyone, including the protocol operator. This is what GDPR Article 17 calls right-to-erasure, achieved cryptographically rather than by trust.
Public-chain audit anchor. Build commitments and protocol events are anchored to a public chain so independent auditors can reproduce the running state from public artifacts.
Cross-vendor sharing with consent. A memory cell can be shared (temporarily or permanently) with another agent — possibly from another vendor — and revoked at any time.
Apache 2.0 license. Source is permissively licensed; anyone can self-host, audit, fork, or build on top under the license’s terms.

Where the field stands

Most of the field competes on retail convenience — storage, retrieval, context. The four properties below are the bar businesses and regulated enterprises audit against, where memory is an asset someone must answer for rather than a cache. License is compared in the table underneath; it is a category, not a coverage level, so it is not charted here.

At-a-glance table

Each entry reflects what each product’s canonical documentation states. Reviewed 2026-05-07; every entry re-verified against current documentation on 2026-08-30. Where a property is not addressed in the docs reviewed, the entry is marked not addressed rather than asserting the product does not do it.

Property	SAIHM	Mem0	Zep	Letta (MemGPT)	LangMem	Pinecone
The four hard parts — open ground under Apache 2.0
User-held encryption keys	Yes HKDF from a secret only you hold	Not addressed	Not addressed	Not addressed	Not addressed defers to host storage	Partial CMEK in your own AWS KMS; project-level, not per end user
Per-memory cryptographic erasure	Yes DEK destroyed on `forget`; GDPR Art. 17	Partial record removal; embeddings and backups not addressed	Not addressed docs describe facts invalidated with a timestamp, not removed	Partial DB block delete; not stated as cryptographic	Not addressed	Partial CMEK is project-level and customer-controlled; effect of key deletion on stored data not stated
Public-chain audit anchor	Yes build commitments and protocol events on a public chain	Partial OSS request log; not chain-anchored	Not addressed	Not addressed	Not addressed	Partial audit logs on Enterprise; proprietary, not chain-anchored
Cross-vendor sharing with consent	Yes temporary, permanent or syndicate grants, revocable	Partial LLM-agnostic; portability across vendors not addressed	Not addressed	Partial shared blocks within one deployment; cross-vendor not addressed	Not addressed	Partial export, not consent-based sharing
Licensing
License	Apache 2.0	Apache 2.0 (OSS) + commercial cloud	Graphiti engine Apache 2.0; Zep Cloud proprietary; Community Edition deprecated	Apache 2.0	MIT	Proprietary (BYOC option)

What each one does well

Honest acknowledgment of each competitor’s actual strengths in their own positioning:

Mem0

Positions itself as a “universal memory layer for AI Agents”, LLM-agnostic by design (works with OpenAI, Anthropic, Ollama, or your own model). Apache-2.0 OSS core plus a managed cloud tier. Backed by a published research paper on the production memory architecture. OSS self-host gives operators full control of stack and data.

Zep

Positions itself as a “Context Engineering & Agent Memory Platform”. Built on a temporal knowledge graph engine (Graphiti, itself Apache-2.0). Strong context-engineering primitives: episode model, business-data integration, behavioral context assembly. Pricing is credit-based (1 credit / 350 bytes / Episode).

Letta (formerly MemGPT)

Positions itself as “the platform for building stateful agents: AI with advanced memory that can learn and self-improve over time”. OS-paradigm tiered memory (Core / Recall / Archival), Agent Development Environment tooling, multi-agent shared memory blocks within a single Letta deployment, Apache 2.0 self-host, plus a managed cloud tier.

LangMem

Positions itself around “helps agents learn and adapt from their interactions over time” — extracts info, refines prompts, maintains long-term memory. MIT-licensed, zero-friction install (“no API keys, no accounts, no monthly bills”), deep LangGraph integration, and storage-agnostic functional primitives.

Pinecone

Positions itself as “The vector database to build knowledgeable AI”. Mature managed vector infrastructure with CMEK + audit logs + HIPAA + PrivateLink + BYOC at the Enterprise tier. Large ecosystem and broad adoption as a vector DB. Note: Pinecone is principally a vector store, not a stateful-memory product per se — included here as the canonical “memory infrastructure” comparator that buyers often evaluate alongside the others.

What is genuinely uncontested

From the canonical documentation reviewed (May 2026), no surveyed competitor publicly addresses:

Per-memory user-driven cryptographic erasure. Pinecone CMEK is the closest — a customer-controlled key in your own AWS KMS — but it is one key per project, not one per memory or per end user, and the documentation reviewed does not state what deleting that key does to stored data.
Public-chain anchored audit trail.
Consent-based memory sharing across different vendors (Letta has intra-deployment shared blocks; Mem0 is LLM-agnostic but its memory is not portable across vendors).

That gap has been measured by people with no stake in it. In Ghost Vectors, independent researchers reconstructed soft-deleted embeddings across three HNSW implementations by reading the raw index files directly, bypassing the API that reported the records as gone: they recovered 100% of patient age and gender, 99% of facial identity and 25.5% of exact names. The same authors propose encrypting each record and discarding the key, which reduced recovery to zero. That is the mechanism SAIHM ships, arrived at independently.

Two honest caveats. EDPB Guidelines 5/2019 set the erasure bar at verifiable and irreversible; the EDPB has not formally endorsed cryptographic erasure, though some data protection authorities accept it. And the Ghost Vectors result is about vector indexes generally — it is not a finding about any named product on this page.

SAIHM’s positioning is not “do less than Mem0” or “do more than Pinecone” — it is to address a different surface. If those three properties matter for your use case (regulated industries, multi-vendor agentic ecosystems, public-good accountability), SAIHM is currently the only canonical option in this list. If they do not matter, the products above each have legitimate strengths in their own positioning — and several are excellent within those positions.

How to choose

Need vector search at production scale, no key-sovereignty requirements? Pinecone for the vector layer.
Want an OSS memory layer that is LLM-agnostic and library-shaped, with optional managed hosting? Mem0.
Building on LangChain/LangGraph and want zero-config memory primitives under MIT? LangMem.
Want stateful agents with OS-paradigm tiered memory, comfortable with intra-deployment sharing? Letta.
Need temporal-knowledge-graph context engineering with business-data integration? Zep.
Need user-held keys, cryptographic erasure, public-chain audit, cross-vendor consent sharing, all under Apache 2.0? SAIHM.

Not sure which kind of memory you need before comparing products? Work through the agent memory decision matrix first — it tells you when the answer is a vector store or your vendor’s built-in memory rather than any product on this page.

The categories above are not mutually exclusive. SAIHM is designed to compose with vector stores and other memory layers under it — explicitly a sovereignty/erasure/audit/sharing layer, not a vector index.

Background reading

This page compares named products. The pages below cover the underlying architecture, which is what decides most of the rows in the table above.

AI agent memory — the four kinds, and who can technically read each one.
Memory security — the threat model, including the parts encryption does not fix.
Memory protocol — why portability is a property of the protocol layer rather than a product feature.
Persistent memory — what memory has to survive: the session, the machine, the app, the model, the provider.
MCP memory — what MCP standardizes and what it deliberately leaves to the server.
Multi-agent memory — coordination between agents, swarms and robot fleets.

Common questions

Which AI agent memory products support user-held encryption keys?: Of the six reviewed, SAIHM is the only one where the end user holds the key. Pinecone comes closest: CMEK is a customer-controlled key in your own AWS KMS, but it is one key per project, not one per end user. The documentation reviewed for Mem0, Zep, Letta and LangMem does not address key custody.
Can an AI memory product actually satisfy GDPR Article 17?: Deleting a record and making it unrecoverable are different claims. SAIHM destroys the encryption key for that specific cell, so the ciphertext cannot be read by anyone afterwards, including whoever runs the protocol. The other five products reviewed describe record deletion rather than key destruction; Zep’s documentation describes facts being invalidated with a timestamp rather than removed. EDPB Guidelines 5/2019 set the bar at erasure that is verifiable and irreversible. The EDPB has not formally endorsed cryptographic erasure; some data protection authorities accept it.
If I delete a vector, is it gone?: Not reliably. Independent researchers reconstructed soft-deleted embeddings across three HNSW implementations by reading raw index files, recovering 100% of patient age and gender, 99% of facial identity and 25.5% of exact names — see Ghost Vectors. Encrypting each record and discarding the key reduced recovery to zero in the same study.
Is SAIHM a replacement for Pinecone or a vector database?: No. SAIHM is a sovereignty, erasure, audit and sharing layer, not a vector index. It is designed to compose with a vector store underneath it. If your requirement is production-scale vector search and you have no key-custody requirement, use a vector database.
What should I use if I have no regulatory requirements?: Probably not SAIHM. If nobody has to answer for where the memory lives, the products above are each strong within their own positioning, and several are excellent. Work through the agent memory decision matrix first — it will tell you when the right answer is a vector store, or your vendor’s built-in memory, rather than any product on this page.
How current is this page?: Entries were researched on 2026-05-07 and re-verified against current vendor documentation on 2026-08-30. Claims about third-party products go stale; check the vendor source links below before relying on any row. If an entry is wrong, email ops@saihm.coti.global and it is revised on receipt of a canonical source and the page re-dated.

Sources reviewed

All facts above are sourced from the canonical pages listed below. Researched 2026-05-07; every entry re-verified against current documentation on 2026-08-30. Where a fact was not stated in canonical docs, the entry was marked not addressed rather than inferred.

Mem0: mem0.ai · docs.mem0.ai/open-source/overview · github.com/mem0ai/mem0
Zep: getzep.com · getzep.com/pricing · Zep OSS direction blog
Letta: letta.com · github.com/letta-ai/letta · docs.letta.com/concepts/memgpt · multi-agent shared memory
LangMem: langchain-ai.github.io/langmem · LangMem SDK launch · LICENSE (MIT)
Erasure research: Ghost Vectors — reconstruction of soft-deleted embeddings from vector index files · EDPB Guidelines 5/2019
Pinecone: pinecone.io · CMEK guide · security overview · BYOC blog

Reusing this comparison? Take the data, not a screenshot: agent-memory-property-matrix.json carries every cell with its review date, staleness note and per-vendor source link, under CC BY 4.0. The chart above is deliberately not offered as a standalone image — claims about other companies go out of date, and a picture keeps asserting them after the data has been corrected.

Get in touch

Questions about this comparison, or an entry that is now incorrect (positioning changes, license changes, new feature)? Email ops@saihm.coti.global. Entries are revised on receipt of canonical-source disagreement and the page re-dated.

Try the protocol → or build on top — see /competitors