Mnemosyne · say “ne-MOSS-uh-nee” · the Titaness of memory

Fool the model. The record still holds.

Mnemosyne is a company brain you run on your own infrastructure. It is being built so the language model may propose facts and may never author the record: everything above a single fact is assembled deterministically, adjudicated before it is kept, and written to a signed chain. An answer that cannot be traced to a source is not an answer it is allowed to give.

The model proposes. It never decides what is true.

Talk to us about early access What the demo will show

the gate · every claim must dereference to an anchored source

Every claim must dereference to an anchored source. No anchor, no answer.

Anchored— this fact exists on the chain
Passed the gate— grounded, cleared, entailed
Blocked— no anchor, or not cleared
The chain— tamper-evident record
Raw— un-curated source material

How is this different from Copilot or NotebookLM?

It is the first question everyone asks, and it deserves a precise answer rather than a slogan.

Copilot · NotebookLM · most “chat with your docs”

They are RAG.

Every query, they retrieve raw chunks of your documents and let the model author an answer out of them. That answer is ungrounded — the model can blend or invent. It is unverifiable — nothing checks its provenance outside the model. It is non-compounding — it is re-derived from scratch every single time you ask. And it happens in someone else’s cloud, with no need-to-know enforcement and no tamper-evident record of what was retrieved.

Mnemosyne

This is designed not to be RAG.

The design curates your sources once into a verified, interlinked knowledge structure that compounds. The model proposes single facts anchored to the exact span they came from; every level above that is assembled by deterministic workers, not by the model. Retrieval enters at whatever level the question needs rather than reranking chunks — and how often something has been read never makes it rank higher, because popularity is not evidence. Every claim then has to clear an adjudicator that runs outside the model before it is kept or served.

RAG re-derives every query · Mnemosyne curates once, and compounds

Pay once to curate. Recall cheaply and provably, thereafter.

The honest economics

We will not be cheaper per document. The design deliberately pays more, once, to curate. After that, recall is a cheap lookup of verified distillations — and it stays cheap for as long as the company exists. A RAG tool pays a little on every query and re-derives the same answer, unverifiably, every time. That is the trade, and it is a trade: if your documents change hourly and nobody ever needs to defend an answer, RAG is the cheaper tool and we will tell you so.

Four things those tools structurally cannot do

Give you an answer you can depend on completely — because nothing verifies the model’s claims from outside the model.
Tell you who knew what, and when — because there is no tamper-evident record.
Enforce need-to-know that holds even when the model is fooled — because the boundary lives inside the model’s obedience.
Keep your data inside your perimeter — because the data is the product.

Three guarantees the design puts outside the model

The model is untrusted by design. Each guarantee below is specified to be enforced by machinery the model does not control and cannot talk its way past. All three are locked in specification and none of them is built yet — this section describes an architecture, not a running system.

Verifiable

Every claim must dereference to an anchored source.

The model’s only job at ingest is to propose single indivisible facts, each anchored to the exact span of the document it came from; anything that does not anchor is rejected. Everything built above those facts is assembled by deterministic workers. When she answers, every claim must resolve back down to one of those anchors, and a claim with no anchor is a fabrication the adjudicator is specified to block. The model is never trusted to police itself.

Accountable

A tamper-evident record of every ingest, question, retrieval and answer.

Signed, hash-chained blocks with Merkle roots, running locally inside your deployment across a spine and five sidechains, with the adjudicator’s verdicts and their proofs written to their own audit chain. Alter one block and the chain says so, immediately and mathematically. “Who knew what, and when” stops being a question you argue about and becomes one you can answer.

Honest about its own gaps

She answers, or she says precisely what she does not know.

A truthful “I don’t know” is designed as a rewarded outcome rather than a fallback, and each gap is recorded as a question the company has asked — over time, a map of what nobody has written down. Every answer also declares what was still unread when it was given, because “I don’t find that” is false, and worse than a refusal, when the document is merely still in the queue. And what she infers from conversations is quarantined from what documents prove: conversations tell her where to look, documents tell her what is true, and there is exactly one gate between them.

Need-to-know: what we are deliberately not building yet

Mk1 shipped compartmented access control: clearance evaluated per source at the moment encryption keys were wrapped, so a reader without clearance received no key and therefore no plaintext — a lattice rather than a display filter. It worked, and it is the single strongest thing we have built. It is also the reason Mk2 exists: we built it before the system underneath it could reliably answer a question, and no amount of access control rescues a brain that cannot find its own evidence.

two askers · three compartments · no clearance means no key

Decided on the server, before the bytes exist.

So for Mk2 this is Stage 2, and we have deliberately written no specification for it while Stage 1 is unfinished. One piece of groundwork is already locked, because it cannot be retrofitted: every access decision is made on the server before any bytes are rendered. An interface that fetches data and hides the rows you may not see has already sent them to you. That single invariant is what lets compartmented access land in exactly one place when we build it.

Tamper with one block, and the whole chain says so.

The design writes every ingest, every question, every retrieval and every answer to a local, append-only chain of signed blocks — a spine with five sidechains, one per domain of events. Nothing has to leave your network to make this true, and it costs nothing to run. Sealing happens at a real boundary rather than on a timer, and verification runs before anchoring rather than after.

a spine of signed, hash-chained blocks · alter one and the chain says so

Tamper with one block and the whole chain says so.

To be unambiguous, because security buyers rightly ask: there is no public blockchain here, no token, and no cryptocurrency of any kind — and no wallet, no coins, and no fee, ever. The chain is a local notary that runs inside your own deployment. Anchoring its root to an outside ledger — Bitcoin, via public timestamping calendars — is a switch you control: it publishes one hash of a hash, never your data. Those calendars aggregate every submitter into a single transaction they pay for themselves, which is why it costs nothing. Mk1 did this for real and confirmed anchors in Bitcoin blocks; Mk2 specifies it again and has not yet built it.

read this section first

What we do not claim

Most vendors tell you what their product cannot fail at. We would rather tell you where it can. If you are paid to be skeptical, this is the section you should read first.

The words we never use

We do not say our system is proof against prompt injection, and we do not say it is free of fabrication. Prompt injection is the number one item on OWASP’s LLM risk list and NIST has called it the greatest security flaw in the technology. EchoLeak (CVE-2025-32711, CVSS 9.3) was a zero-click injection that broke Microsoft 365 Copilot and walked straight past Copilot’s own classifier. Any vendor promising you immunity is one disclosure away from being publicly wrong.

We do not need the promise. We assume the model will be fooled, and the architecture puts the guarantee somewhere the model cannot reach: it may propose facts, and it may never author the record.

None of this is built yet.

This is the limit that outranks every other one on the page. Mk2 has 39 specifications and zero lines of product code. A locked specification is a ratified mechanic with its dependencies named and its reversal conditions written down — it is a great deal more than an intention, and it is a great deal less than working software. Every capability on our documentation page is badged accordingly, and the badges are generated from a single ledger that a gate refuses to let us overstate.

Grounding is not correctness.

The design proves that a claim is grounded in an anchored source. It does not prove the model reasoned correctly over the sources it was allowed to read. A wrong inference over authorised data is a real failure mode. We attack it with claim-level entailment checks and rewarded honest abstention — the system is designed to say “I don’t know” — and we do not assume it away.

The learning may not earn its keep.

One learner is designed to discover how your organisation’s knowledge is shaped and how to move through it, holding not a single fact in its weights. Its governing rule is a limit rather than a boast: it may make her faster and sharper, and it may never make her correct. Whether it beats a plain frozen-embedding baseline on real company documents is an untested hypothesis, and our own design review noted the uncomfortable corollary — a learner that has silently learned nothing looks exactly like one that is working.

A local model is a weaker model.

If your data cannot leave your building, you do not get to use the largest frontier model. The architecture blocks fabrication, but it cannot make a smaller model smarter. We would rather set that expectation now than have you discover it in month three.

Semantic leakage is open engineering.

A compromised model could try to encode a restricted fact into prose carrying no citation at all, laundering it past a gate that only matches provenance. That is a genuine problem, it is the hardest one in this space, and it belongs to the stage we have not started. We are naming it rather than pretending it is solved.

Two ways to run it. Both keep the keys yours.

On-premise, air-gap-capable

The whole system runs on your metal, behind your firewall, with a local model. Nothing egresses. For organisations where that is not a preference but a legal requirement — government, defence, healthcare, legal, IP-heavy engineering.

An attacker who fools the model needs somewhere to send the data. In an air-gapped deployment, there is nowhere.

Managed — we run the host, you hold the keys

A private instance we operate for you. The specification is explicit that this is the same binary, the same cryptosystem and the same chains, and that the keys column is identical between the two modes: the customer holds them, and nobody else can reach plaintext. Managed differs in who racks the hardware, not in who can read.

That obliges us to defend against ourselves, and the design says so in those words: managed has to contain one extra adversary — us, or anyone who compromises our infrastructure or an employee of ours. Updates are applied blue-green and re-attested rather than in place. Designed, not yet built.

Where we actually are, stated before anything else

Mnemosyne Mk2 is a design, not a product. There is no code yet, there is no running system, and there are no customers. We would much rather you hear that in the first paragraph than discover it in the third meeting.

What does exist is unusually complete for this stage: 39 specifications covering ingestion, retrieval, reasoning, adjudication, provenance, learning, deployment and licensing, with 182 ratified design decisions behind them. Thirty-four of those specifications are locked — the mechanic is fixed, its dependencies are named, and each decision records what evidence would reverse it. One has passed the stricter bar we call implementable. Construction of the first feature has started.

There is a reason for that order, and it is the most useful thing we can tell you about how we work. Mk1 was real: it ingested documents, sealed them into a tamper-evident chain anchored to Bitcoin, and enforced compartmented access control. It was also built back to front — security and machinery first — and when we finally sat down and asked it a basic question about a real document, it found its own best evidence and threw it away. We had built the vault before the door. So we archived the whole thing and started again, fundamentals first: make her reason and answer over company documents, then tighten security on top of a working core. Never the reverse.

We are looking for a small number of design partners: organisations with a real problem in this shape, who will help us prove this on their own documents, under NDA, at a deliberately small scope.

Talk to us about early access

There is no demo to sign up for yet, and this form does not pretend otherwise. It is for the conversation before there is one: if you have documents that need answering over and answers that need defending, we want to understand that problem while the system is still being built — which is the only point at which your problem can still shape it. Under NDA, at whatever scope you are comfortable with.

We are not going to show you a demo that does not exist yet. The specifications are finished and public-facing documentation for them is on this site; the first working feature is being built now. Watch it now →

Questions we get asked

How do you pronounce it?: ne-MOSS-uh-nee. The leading M is silent. Mnemosyne is the Titaness of memory in Greek myth, and the mother of the Muses — which made her hard to improve on as a name for this.
Can I use it today?: No. Mk2 is a design: 39 specifications, 182 ratified decisions, and no running code. The first feature — she answers a real question about a real document — is in construction. If that timing works for you as a design partner, we would genuinely like to talk; if you need something in production this quarter, we are not it, and we would rather say so.
You had a working system. Why throw it away?: Because it could not answer a basic question. Mk1 had real cryptography, real anchoring and real access control, and underneath all of it the retrieval layer was finding its best evidence and discarding it. We had built the vault before the door. Rebuilding fundamentals-first was the cheaper of the two options, and the archived system remains available to us to reuse where it was genuinely good — the cryptography and the chain machinery in particular.
Is this a blockchain product?: No. There is no public chain, no token, and no cryptocurrency — and no wallet, no coins, and no fee. The “timechain” is a local, signed hash-chain designed to run entirely inside your deployment: it costs nothing, exposes nothing, and needs no external network to work. Separately, its root can be anchored to Bitcoin — that step does reach a public timestamping calendar, publishing a single hash and never your data. It is a switch you control, and it is not what the product is about.
Does anything leave our network?: In the on-premise mode, by design, no. The language model runs locally, the knowledge lives locally, the chain is local. There is no mandatory outbound connection — which is itself a security property, because an attacker who fools the model still has nowhere to send anything.
Which model does it use?: A local one, served by Ollama or vLLM — your choice of open-weight model. We are deliberately model-agnostic: the model is the untrusted component, so the architecture avoids depending on any single one of them. It is also why the model’s job is kept as narrow as it is.
What does it cost?: We do not know yet, and we would rather tell you that than invent a number. Pricing will be discovered with our first design partners against what the system is actually worth to them.
What can it not do?: We wrote that down. It is the “What we do not claim” section above, and we put it on the front page on purpose. The first item is that none of it is built yet.

Get notified

Occasional notes on what we are building — the first feature working, the demo going live, the design-partner programme opening. No noise, no list-selling. The list runs on our own mail server, not a third party’s, which for a product with this pitch seemed like the minimum.