[All resources](https://goodmem.ai/resources) GoodMem · Security & Trust Brief # Built Like Enterprise Infrastructure Source: Title: Built Like Enterprise Infrastructure — GoodMem > GoodMem enterprise controls: resource-aware access, scoped API keys, PostgreSQL, and verified releases. Built by ISO 27001-certified PAIR Systems. Resource-aware access control, a standard PostgreSQL data layer, and a verifiable supply chain — GoodMem’s trust posture for production PAIR Systems engineering · September 2026 [Download PDF](https://goodmem.ai/whitepapers/GoodMem-Built-Like-Enterprise-Infrastructure.pdf) **Engineered runtime** Java 21 typed server with familiar JVM operational tooling **Portable data layer** PostgreSQL memories, vectors, access policy, jobs, and retrieval logs **PAIR Systems certified** ISO 27001 SOC 2 Type II audit in progress Enterprise memory infrastructure needs controls that operators can inspect and administer. GoodMem combines a typed Java 21 server, PostgreSQL persistence, resource-aware access control, and a verified delivery pipeline. Human users and service identities can share memory under explicit permissions, while scoped API keys limit what each credential can do. PAIR Systems is ISO 27001 certified; its SOC 2 Type II audit is in progress. ## A familiar operational foundation GoodMem runs as a Java 21 service and keeps core application data in PostgreSQL: memories, extracted text, dense and sparse embeddings via pgvector, requested page images, authorization records, background jobs, and retrieval logs. Operators can inspect these records with SQL and use their existing database backup and access practices. Core persistence needs no separate vector database or message broker. Deployment configuration and TLS key material also need appropriate backup and protection. Keeping application data in PostgreSQL makes its storage familiar and portable; encryption at rest and backup retention remain deployment responsibilities. ## Access control for people and workloads GoodMem includes instance-level ADMIN and USER roles and a space-level role ladder: viewer, contributor, content manager, and administrator. Direct grants can authorize specific resources or supported groups of resources. Access-policy administration, ownership transfer, and authorization checks are available through the APIs and console. The server enforces policy for the requested operation and resource, including filtering visible collections in PostgreSQL. Human users and service identities have separate lifecycles. One-time enrollment credentials support human onboarding, while workload identity stays independent of any individual API key. Scoped keys are bounded by an immutable issuance ceiling intersected with the subject’s live permissions; service-identity keys must be scoped. Issuance checks prevent a credential from granting authority beyond its issuer or subject. Model use is also separate from secret disclosure: reading or executing a provider resource does not automatically authorize reading its credentials. Built-in roles are code-defined, and access partitions within one instance are not hard tenant boundaries; supported tenant isolation uses separate databases. ## A verifiable software supply chain The GoodMem server image runs non-root on a distroless Java 21 base without a shell or package manager. The normal installer verifies signed SLSA Build Level 3 provenance and checks the pulled image against its attested digest. Verification can be explicitly disabled by the operator. Before publication, the release workflow verifies installation and upgrade with the newly signed artifacts, as well as CLI provenance. Offline CLI upgrades can verify a supplied local provenance bundle. Release dependencies include blocking OSV vulnerability checks and FOSSA license-policy checks, with third-party attribution material published alongside the release. Server and CLI security pipelines generate SBOMs. Grype adds a separate reporting scan. Dependency scanning honors documented exclusions, so these controls are not a promise that every release has zero unresolved CVEs. The server uses Bouncy Castle FIPS providers with approved-only mode enabled by default. The standard build’s BC-FJA 2.1.2 module is not currently validated; the normal CLI and database are outside that server cryptographic boundary. Consult the FIPS documentation for the exact deployment scope. ## Treat retrieved material as data Permission to contribute memory does not make the contributor’s text trusted instructions. GoodMem’s synthesis path applies a mandatory policy and request-specific delimiters around retrieved records. Hosted MCP responses label contributor-controlled content as untrusted and carry source provenance; generated answers are identified as model output derived from those sources. These controls help consumers preserve the distinction between evidence and instructions. Extension handling has an administrative boundary too: the built-in USER role has no extension-management authority, and plugin loading selects active JAR extensions. These controls reduce exposure; they do not guarantee that arbitrary plugins or model responses are safe. ## Operate, observe, and integrate GoodMem exposes native Prometheus metrics for the JVM, HTTP, gRPC, and PostgreSQL, with liveness, readiness, and startup probes plus standard gRPC health checks. Lifecycle controls support graceful draining. Database startup retries transient connection failures with bounded backoff; migrations run outside that retry loop. Request IDs correlate the REST-to-gRPC resource API. Retrieval requests can be persisted through caller opt-in or administrator logging policies, including request, outcome, and provenance information. This logging is asynchronous and best-effort; it is not an exhaustive audit of all API operations. Document processing includes configurable OOXML extraction limits and bounded XLSX page-image rendering. Page images are generated when requested for supported inputs and expose processing status. TLS supports customer certificates, development self-signed certificates, and native ACME issuance, renewal, and reload. Integration uses protobuf-defined gRPC, REST with a live OpenAPI specification, and a built-in MCP server. Maintained clients cover Python, Java, TypeScript, Go, and .NET. ## Preserve memory while choosing your models GoodMem’s standard indexing path extracts, chunks, embeds, and indexes source content without requiring a generative memory-extraction step. Retrieval combines vector search with optional reranking and optional synthesis. Original content and extracted text remain stored alongside the index, with page images available when requested. Embeddings support OpenAI, Cohere, Jina, Voyage, DashScope, Gemini Embedding 2, TEI, and vLLM. Gemini execution currently supports text inputs. Reranking supports Cohere, Jina, Voyage, DashScope, TEI, vLLM, and llama.cpp. Optional synthesis supports OpenAI-compatible endpoints, OpenRouter, LiteLLM, DashScope, vLLM, Ollama, and llama.cpp. An agent or summarization-model change does not inherently require rebuilding the memory corpus. An embedding-model change is different: in-use embedder core fields and a space’s embedder associations are protected from modification. Moving to a different embedding model requires rebuilding embeddings through an appropriate re-ingestion workflow; automatic migration is not implied. A deployment can keep AI processing inside its own boundary by using self-hosted model endpoints and configuring any OCR endpoint it uses accordingly. Local processing is an explicit deployment choice, not an assumption about default endpoints. ## Security and supply chain, side by side **Scoped security and supply-chain comparison of GoodMem, LangGraph, LlamaIndex, and Flowise** | Security & supply chain | GoodMem | LangGraph | LlamaIndex | Flowise | | ------------------------ | ------------- | ----------- | ----------- | ----------- | | Runtime | Java 21 · JVM | Python | Python | Node.js | | Application store¹ | PostgreSQL | PostgreSQL | Pluggable | SQLite / PG | | Distroless image | Yes | N/A | N/A | No | | Non-root image | Yes | N/A | N/A | Yes | | Build provenance² | SLSA L3 | Off | Assets only | BuildKit | | Security scanning³ | OSV gate | CodeQL gate | CodeQL | No CI step | | SBOM availability⁴ | Build SBOM | Repo SPDX | Unverified | Repo SPDX | | Dependency-license gate⁵ | FOSSA | No CI step | No CI step | No CI step | Green: confirmed control. Amber: absent or limited in the reviewed scope. Gray: neutral, not applicable, or unverified. ¹ Application persistence: LangGraph supplies a PostgreSQL checkpointer; LlamaIndex integrates storage backends; Flowise supports SQLite and PostgreSQL. Library distributions are N/A for server-image controls. ² Provenance differs in scope and assurance. LangGraph disables PyPI attestations. LlamaIndex attests bundled static assets, not its complete wheel. Flowise 3.1.4 includes BuildKit provenance for both image architectures; this does not establish SLSA L3. ³ GoodMem’s OSV dependency scan gates release, with exclusions. LangGraph’s public branch rules require CodeQL before merge; LlamaIndex runs CodeQL in CI. CodeQL analyzes source code, not dependency CVEs. No security-scanner step appears in Flowise’s reviewed public CI. ⁴ Build SBOM: generated in GoodMem’s server/CLI security pipelines. Repo SPDX: GitHub dependency-graph exports retrieved for LangGraph and Flowise, not release-artifact SBOMs. LlamaIndex’s export failed three times with HTTP 500 timeouts; its SBOM availability remains unverified. ⁵ No CI step: no dependency-license policy check in the inspected public release workflows and invoked build scripts. This is not a claim of license noncompliance or absence of private controls. Flowise’s proprietary-path guard is a different control. **Methodology. **GoodMem claims were checked against server-v1.0.316 (536fa0b57), its server and database implementation, installer, and SLSA release workflow v1.0.15. Competitor source snapshots: LangGraph 81bf17b, LlamaIndex d2ac544, Flowise 9291856. The September 4, 2026 review also inspected published PyPI/container artifacts, GitHub SBOM exports, and public branch rules. Hosted offerings and private controls are outside scope. This is not a new certification or penetration test. PAIR Systems is ISO 27001 certified; SOC 2 Type II remains in progress. © 2026 PAIR Systems, Inc. [Access control](https://docs.goodmem.ai/docs/reference/security/access-control/) [API-key ceilings](https://docs.goodmem.ai/docs/concepts/api-keys-and-ceilings/) [FIPS boundary](https://docs.goodmem.ai/docs/reference/security/fips-compliance/) [SLSA release workflow](https://github.com/PAIR-Systems-Inc/slsa/blob/v1.0.15/.github/workflows/slsa-release.yml) [LangGraph release source](https://github.com/langchain-ai/langgraph/blob/81bf17b23123e4ef8b9d5f49fa09a0122fc2edd1/.github/workflows/release.yml) [LlamaIndex release source](https://github.com/run-llama/llama_index/blob/d2ac544a27c73d2a68e9c57efec4b2ac0ef99892/.github/workflows/release.yml) [Flowise image source](https://github.com/FlowiseAI/Flowise/blob/9291856d1ea4a4ceea9f8fef8ce14f4f6c81e8eb/docker/Dockerfile) [LangGraph CodeQL rule](https://api.github.com/repos/langchain-ai/langgraph/rules/branches/main) [LangGraph SPDX export](https://api.github.com/repos/langchain-ai/langgraph/dependency-graph/sbom) [Flowise SPDX export](https://api.github.com/repos/FlowiseAI/Flowise/dependency-graph/sbom) [Flowise 3.1.4 image](https://hub.docker.com/r/flowiseai/flowise/tags?name=3.1.4) [LlamaIndex CodeQL workflow](https://github.com/run-llama/llama_index/blob/d2ac544a27c73d2a68e9c57efec4b2ac0ef99892/.github/workflows/codeql.yml) [Trust Center](https://trust.pairsys.ai/) [Read the docs](https://docs.goodmem.ai/docs) [Start free](https://cloud.goodmem.ai/login?loc=whitepaper-enterprise-infrastructure) [Download PDF](https://goodmem.ai/whitepapers/GoodMem-Built-Like-Enterprise-Infrastructure.pdf) ## Want us to follow up? This report is free to read and share — no sign-up, no wall. If you’d like to discuss a benchmark on your workload, deployment, pricing, or a security review, leave a few details and our team will contact you. Prefer email? We’ll use these details only to contact you about GoodMem. No newsletter, no lists. See our [Privacy Policy](https://cloud.goodmem.ai/privacy).