Trust you can check.
Most products ask you to trust a privacy policy. We'd rather show you the record. Every time the Penny service decrypts your memory, it writes an audit record first. If the record can't be written, the decryption doesn't happen. You can see each one in your dashboard, and the record is sealed into a public, tamper-evident log hosted on a different cloud than your data.
What goes on the public log, and what never does
Out-of-the-ordinary access is published individually, one entry per event, when it happens. That covers support troubleshooting with your consent, an incident investigation, a legal demand, a compliance audit, or a key rotation.
Routine access is sealed once a day. That covers your own reads and exports, plus Penny's automated work such as search indexing and memory upkeep. The day's records are hashed into a single fingerprint and published with a pseudonymous id, the date, and a count.
The log never contains your memory content, your name or email, your account ids, IP addresses, or request paths. It shows that access happened and why, not what was read or whose memory it was.
Find your own access history
Settings → Privacy in your dashboard lists each decryption of your memory by the Penny service, in plain language, with the reason for each. Routine reasons are marked as routine, and anything outside that list is flagged.
How the log is checked
The log is append-only. Each entry changes the log's fingerprint, so an entry that was later changed or removed no longer matches a copy saved earlier. We run the checks ourselves: every ten minutes, a job confirms that recent entries are still in the log.
Two kinds of key use fall outside this record. Unlocking your encryption key is recorded in our cloud provider's audit trail (AWS CloudTrail) rather than in your dashboard. Restoring from an offline backup archive happens outside the running service.
Government requests, and our limits
We commit to publishing every government request for user data in this log, to the maximum extent the law permits. We will resist overbroad requests and disclose only what we are legally required to.
Be clear-eyed about the limit: because we hold the encryption keys, our architecture cannot cryptographically stop disclosure compelled by valid legal process. If your threat model needs cryptographic defense against US legal process, Penny isn’t the right product for you.