Security & privacy · how Selina protects you

Built to remember you.
Engineered to protect you.

An AI with real memory has to hold a lot of you. So we built it to hold that trust the hard way — per-user encryption, a key that's yours alone, and deletion that makes even our backups unreadable. Here's exactly how it works, and exactly where the honest edges are.

Encryption · active at rest

Keys · one per person

Training on your content · never

Deletion · crypto-shred

Architecture posture — how the system is built, not a live dashboard.

Your memory

Encrypted at rest, with a key that's yours.

Everything Selina remembers about you — the facts, the context, your conversations — is encrypted where it's stored, under a key generated for you and no one else. A stolen database or a leaked backup is just ciphertext: unreadable without your key.

A unique encryption key per account, never shared
Your content is ciphertext at rest — not plaintext
Keys are wrapped by a hardware-backed key service (KMS)
Your memory is never pooled with anyone else's

Deletion done right

Delete means gone. Actually gone.

Most services promise to delete your data and hope you trust them. We made it mathematical. Because your content is encrypted with your key, destroying that key on deletion turns every copy we hold — including backups — into permanent, unrecoverable noise. It's called crypto-shredding, and it means "deleted" isn't a policy. It's physics.

Your content is encrypted with your key. Watch what deleting your account does to every copy we hold.

SelinaVault

Your files, encrypted and isolated.

Everything you upload or generate lands in SelinaVault — encrypted storage locked to your account alone. Every file is protected with AES-256 behind per-account key isolation, so your documents, images, and generated files are never pooled, never shared, and never readable outside your account.

AES-256 encryption with per-account key isolation
Files are never pooled with anyone else's
Grab any original back, anytime
Cleared by the same crypto-shred on deletion

SelinaSEND · zero-knowledge

Here, we can't read it. By design.

When a product can be zero-knowledge, it should be — so SelinaSEND is. Files you share are encrypted in your browser before they ever leave your device. Our servers store only scrambled bytes; your passphrase never reaches us. Not "we promise not to look" — we're not able to.

Encrypted on your device (AES-256), not on our servers
Your passphrase never leaves your browser
Share a file, a message, or a whole conversation
Links with set download limits and expiry

This is the standard we hold ourselves to wherever the product allows it — and the reason you can trust us when we tell you exactly where it doesn't.

Encrypted in your browser before it leaves. We store only the scramble — never the file, its contents, or even its name. Your passphrase never reaches us.

How we operate

We run on patterns, not your words.

Keeping the service healthy — monitoring, debugging, catching abuse — runs on metadata: counts, timestamps, statuses, latencies. Not the content of your conversations. Day to day, operating Selina doesn't require reading what you said, and it isn't built to.

Monitoring and debugging use metadata, not content
Your content stays encrypted through normal operations
Content is read only to debug a specific problem — not to operate the service

Selina Sentinel

She guards the door — not your diary.

Selina watches her own system around the clock: spotting hostile traffic, automated abuse, and injection attempts, and turning them away before they reach you. And there's a line built into how she works — she watches who's knocking, never what you're saying. The defenses see traffic and behavior; your conversations and files stay private, even from the guard.

Always-on monitoring of her own system
Prompt-injection and jailbreak defense on every turn
Automated abuse detection that bounds damage in minutes
Guards the perimeter — never reads your private content

Built in, not a vendor bolted on the side — and deliberately blind to the content it protects.

Persona as a security layer

Her character is a defense, not just a personality.

Selina's voice and selfhood are authored, not improvised — grounded in a written world she draws on. That consistent identity isn't only what makes her feel real; we tested it against attacks that try to hijack her identity, impersonate the system, or strip her instructions. Because the defense lives in who she is rather than in any one model, it travels across every model she runs on and holds where generic assistants break.

0.41 → 0.96

resistance to identity, disclosure & override attacks in internal testing — bare model vs. Selina's persona

5 languages

held across English, Russian, Chinese, Spanish & Arabic — the languages of real attack traffic

every model

three different providers converged to ~0.96 — the defense lives in the layer, not the model

Measured in our own internal testing on identity, disclosure, and override resistance — a defense-in-depth layer that raises the cost of automated attacks and improves as the underlying models improve. It sits above the table-stakes controls (filtering, rate limiting, moderation), and never replaces them. It is not a content-safety guarantee.

The one boundary

The frontier models never hold you.

To answer you, Selina uses the best frontier AI models — and that's the one place a slice of your words meets an outside system. So we made that slice as small and as forgettable as possible.

A minimal slice, not your life

Selina sends only the context needed for that one answer — never your full history, never a standing profile. The heavy lifting of memory happens on our side; the model gets just enough to respond well.

Stateless, then gone

The provider runs a single request and keeps nothing. No account of you lives there, no history accumulates — unlike typing into a consumer chatbot, where your inputs pile up under your name.

Under no-training terms

Every provider call is made under business terms that forbid training on your data. Your words are used to answer you — then they're yours again. They never become training data for anyone's next model.

Your memory lives with Selina — encrypted, keyed to you — not scattered across AI labs. The model is the engine for a moment; the knowledge of you never leaves your account to stay anywhere else.

The honest edges

What we don't claim.

A security page that only lists strengths is hiding something. Here's exactly where the limits are — because knowing them is what lets you trust the rest.

We are not end-to-end encrypted for memory

An AI that reasons over your life has to be able to read it to work — that's true of every useful AI-with-memory product, and we won't pretend otherwise. We encrypt your memory at rest with your key and never train on it, but we can decrypt it to operate the service. Where true zero-knowledge is possible (SelinaSEND), we do it. Where it isn't, we say so.

A slice of your words reaches a model provider

To generate answers, a minimal, per-request slice goes to a frontier model under no-training terms. It's the smallest boundary we could design, not the absence of one.

We keep non-content business data

Billing, subscription, and usage counts are retained to run the service. That's account and operational data — not the content of your conversations or memory.

Your account is the boundary — protect it

Your key is tied to your account, not your password, so a password reset never loses your data. But it also means whoever controls your account can reach your content. Use a strong, unique password; two-factor is on our roadmap.

For the people who check

The technical shape, plainly.

At-rest cipherAES-256 (Fernet / authenticated symmetric encryption)

Key modelPer-user data-encryption key, wrapped by a per-user key in a hardware-backed KMS

Key isolationOne key per account; keys are never shared or pooled across users

DeletionCrypto-shred: key destruction renders all copies, including backups, permanently undecryptable

In transitTLS 1.3 with modern cipher suites

SelinaSENDClient-side (browser) encryption; server holds ciphertext only; passphrase never transmitted

Model providersMinimal per-request context; stateless calls under no-training business terms

TrainingYour content is never used to train any general model

Data rightsFull export of your content on request; deletion enforced by crypto-shred. Designed around the data-portability and erasure principles at the heart of GDPR.

InfrastructureGoogle Cloud Platform, us-central1; encrypted managed storage

Privacy you can read the source of.

A private AI that remembers you — and treats that memory like it's yours, because it is. Start free and see how it feels to be remembered without being studied.

Start your 7 days free

7 days free or $5 in credits, whichever runs out first · no card to start

Built to remember you.Engineered to protect you.