Security and trust

MAGLA Memory isolates customer projects by tenant and subject. Public API keys are scoped to memory:read and/or memory:write; secrets are never returned by account export.

Production deploys are fail-closed, create a consistent commercial database backup before schema rollout, and verify the running process is bound to the current release.

Payment providers cannot write Memory checkpoints or owner/GOLD state.