Governed memory for AI agents, now with an opt-in Jev judge.
Hosted organizations can now opt in to a judge that uses Jev, TypeSafe AI's System One model, to rank recall. Only records your policy clears can reach it, and the local ranker takes over whenever a recall can't be sent. Checking AI-written memories with Jev is planned.
opt-in · off by default · hosted Team and Professional only · the self-hosted core never calls Jev
- ranker
- Jev at a pinned version, or the local ranker on fallback
- egress
- the decision and the policy it came from
- request
- a SHA-256 hash of what was sent, never the text
- provider
- TypeSafe request ID and model
- per memory
- one probability for each memory the judge scored
What an opted-in recall records. Field names, not a published API. No values shown.
Give your agent the right memory — not just more memory.
Heartwood drops records you retire before ranking, then returns each answer with its author and a signature you can check. Add it beside your existing stack with Python or MCP.
python -m pip install "heartwood-memory[recall,mcp]" · embedded Python · local MCP · source-available
from heartwood import Heartwood, Principal
hw = Heartwood(
path="./heartwood.db",
tenant="tenant:acme",
)
hw.remember(
"Refunds over $500 require finance approval.",
subject="policy:refunds",
created_by="agent:support",
)
# signed, provenance-carrying, tenant-scoped recall
principal = Principal(
id="agent:support",
tenant="tenant:acme",
clearance="internal",
)
hits = hw.recall(
"what is our refund policy?",
principal=principal,
)Inspect the proof behind every trust claim.
Product-path enterprise retrieval over 8 queries on a 24-memory trace (nDCG@10 0.818). Measured with the local ranker, before the Jev judge.
Every recalled memory carries its source chain, model version, and signature.
Zero cross-tenant policy leakage under adversarial probes in the single-trust-domain trust suite.
Retrieval, policy, faithfulness, deletion, egress, and resilience gates.
The pre-registered Phase 1 gate, measured warm with the store, index, embedder, and reranker hot in one process. On our hosted gateway, real production p95 measured 795ms across 873 recalls over a 7-day window in July 2026. We publish the benchmark because it is the budget we design hook- and agent-loop integrations against — not a service level we commit to. Measured without the Jev judge.
Policy-before-ranking vs. 0.000 MRR@10 when the same filter runs after the vector search.
Every figure above states how it was measured. Gate results come from executable gates in the Heartwood core with pre-registered thresholds and paired-bootstrap confidence intervals; figures marked as benchmarks are controlled measurements and are not production service levels.
Five ways Heartwood keeps agent memory trustworthy.
Retire what you replace
From version 0.2.10, when a new memory names the one it replaces, or the Heartwood memory tool edits or deletes a file, default recall stops returning the old text, even after a restart. Earlier versions of an edited file stay reachable only when you ask for history. Heartwood does not detect replacements by itself: if a new memory does not name what it replaces, both stay current and the old one can still be recalled.
Filter before you rank
Heartwood removes memories the agent is not cleared to use before the vector search scores them (from version 0.2.9). Restricted records never appear in results.
Trace every answer to its source
Each memory is signed when stored and rechecked when recalled. Results include source IDs, content-hash status, and a provenance tree that follows derived memories back to their origins.
Detect changes in the record
Remember, expiry, supersession, and deletion events join a hash-chained audit log. Verification detects an edited or missing row, so the history can be checked instead of merely trusted.
Integrate without replacing your stack
Use the embedded Python library or a local MCP server beside your existing systems. MCP starts read-only unless you explicitly enable write or erase tools.
Need to erase a subject? Hard-delete destroys the per-subject key, purges governed derivatives, and returns a receipt; it does not claim byte-level deletion proof.
For agents where being wrong is expensive.
Built for teams running high-stakes agents over support tickets, customer records, operational Postgres, internal policy and knowledge bases, and compliance-sensitive workflows — teams that already have agents but need stronger answers for provenance, policy, deletion, and auditability.
Regulated support agents
Answer from policy and customer evidence, cite where every claim came from, and get a key-destruction receipt — key destroyed, derived artifacts purged — when a customer is deleted.
Operations & workflow assistants
Carry workflow memory and audit trails across long-running tasks without leaking one tenant’s state into another.
Research & synthesis agents
Produce source-grounded summaries that are gated on faithfulness before they are trusted as memory.
Compliance-sensitive copilots
Keep restricted material behind classification clearance; on governed generation paths, egress is evaluated before the external-model call — by policy, not by prompt.
The control plane between your agents and your systems of record — not a replacement for your database, and not “unlimited memory.”
See governed recall in one working example.
Install
Add the embedded library with one pip command, or start the local MCP server.
Remember
Store one policy or fact with its subject, source, and access rules. Heartwood signs it and records the write.
Recall and verify
Ask one question, then inspect the returned source IDs, signature status, and recall explanation.
Source-available core. Pay when you need governance backed by a team.
Community
Engineering teams proving the fit.
Free to read, run, and self-host for non-production use at any size. Organizations that qualify as a Small Organization under the licence — fewer than 100 employees and contractors, and under $1,000,000 in total revenue in the prior tax year — may also run it in production at no charge. See the LICENSE for the controlling definition.
- Embedded library (Python) + MCP server
- Provenance, typed memory, policy-gated recall
- Crypto-shred deletion + tamper-evident audit
- Run the public trust-receipts benchmark yourself
- Community support
Team
Organizations taking governed memory from a laptop into production.
Team is sold through a short conversation — we scope the deployment before it starts.
- Everything in Community
- Production recall gateway, hosted by us — serve recall to your app, authenticated and remote (or self-host it from the source-available core)
- Supported production deployment configuration
- Commercial-use license for production
- Email support (no SLA)
- Opt-in Jev judge for recall ranking — off by default; only policy-cleared records are sent
Professional
Organizations governing agent memory under compliance pressure.
Professional is available now. Annual subscription, billed once per year, renews automatically until cancelled.
- Everything in Team
- Dedicated isolated tenant — your own instance, volume, and hostname; per-credential principal binding enforced server-side
- Per-answer evidence — every recall returns a hash-chained audit row and an explain_recall rationale you can re-run
- Priority support with a one-business-day response target (defined in Terms of Service §16.K) and security advisories
Enterprise
Regulated organizations with auditors in the room.
Enterprise is scoped by conversation and billed by custom quote.
- Everything in Professional
- Self-hosted and air-gapped deployment, scoped with you
- Custom framework adapters and audit consulting
Professional is billed annually through Edukas Solutions and renews automatically until cancelled. Team and Enterprise are scoped by conversation. Prices are per organization, in USD. Subscriptions are currently offered to organizations in the United States only.
See whether Heartwood fits your hardest agent.
Bring the agent, the data it recalls, and the rule it cannot break. We’ll map the smallest governed-memory path and show which claims you can verify yourself.