The Marginalia

It already has. SSO ships at every tier, configured by your org owner in the console, and the pricing page says so in plain words:

“SSO is on every tier. Turn it on in the console.”

The security page lists SAML as not built and names what is live instead:

“OIDC single sign-on, SCIM, and TOTP are live.”

If SSO is the gating item, the honest answer is that it is already on every tier.

Cited: Security and trust· Pricing, In every tier

There is not one yet, and the security page does not hide it:

“There is no report yet. We will publish it when it exists, and we do not claim it before then.”

The DPA says when it will exist:

“A SOC 2 report will be made available when the audit is obtained; it is not currently available.”

Until the audit exists, the compliance evidence is the append-only audit trail, the receipts, and the status page, all available on request under the DPA.

Cited: Security and trust· DPA, §10

It costs what the cloud costs: twelve dollars a person a month, at every size and on every term.

“The rate is $12 a person a month, on our cloud and on your servers: the same number at one person and at a hundred thousand, on a month-to-month plan or a multi-year contract.”

There is no self-hosted premium, no floor, no minimum and no term discount: a hundred people cost twelve hundred dollars a month and a thousand cost twelve thousand, whether the image runs in your VPC or on ours. Self-hosting is one image deployed where your fleet lives, with the DPA and the governance layer inside your network; past a hundred people or a hundred agents the contract is billed annually by invoice, at the same rate. Below that the plans are bought in the console, free to five people and five agents, so a fleet of sixty can start on the 90-day pilot at the same twelve dollars a person a month.

Cited: Pricing, Rate card· Pricing, Terms

Yes. Free is $0 for up to five people and five agents, with the same 20,000-character memo ceiling every plan has, and a seven-day audit trail:

“Free, with up to five agents and seven days of audit. No card.”

The rate card’s Free row is the same five, and the step off it is stated plainly: at the sixth person, $0 becomes $12 a person a month, and the free cap on agents (5) becomes the self-serve cap (100 people, 100 agents).

Quota enforcement is technical and automated: exceeding a tier's limits suspends or rate-limits the service until you upgrade.

Cited: Pricing, Lanes· Pricing, Plans

Today the cloud is split across two US regions, and the privacy policy does not dress it up:

“processing is split between US East (us-east-1, Postgres) and US West (us-west2, compute); it is not co-located, and selecting an eu region claim in the console records a contractual commitment to migrate, not a current storage fact”

The security page restates it with the same honesty:

“Cloud processing is split. The database runs in US East on Neon. Compute runs in US West on Railway. The two are not co-located, and a request crosses the country to be answered.”

Setting region: eu records a commitment to migrate. It does not move a byte today.

Cited: Privacy Policy, §5· Security and trust

Yes. It is a printed receipt of the service's state, rewritten every two minutes from the public status file:

“A printed receipt of the service's state, rewritten every two minutes. The stamp tells you when this page was written.”

When the service cannot answer, the page keeps serving the last written copy, and the DPA treats the page as compliance evidence:

“append-only audit trail, receipts, and status page are the compliance evidence”

Cited: Status, the ledger· DPA, §10

Not yet, and the mechanism page is explicit about it:

“The installer ships through the enrolled customer path. The console is self-serve today: create an org and run your pilot there.”

Not today: there is no public download. The installer and the release artifacts stay with the private repository that produces them, so no one-line public install URL resolves. If you already have a design-partner build, an owner mints a one-time enrollment key and machines enroll with airmemo-hook enroll; without the binary, point a client's base URL at the gateway or use MCP, and the agent reads the same context with no install.

Cited: Mechanism, Install

The hook client is proprietary. The terms draw the line in their security section:

“The hook client is proprietary software. AirMemo will make the hook client's source available for Customer's security review under a confidentiality agreement on request, and every hook release is SHA256-pinned and signed so the binary Customer runs is verifiable against the release AirMemo published.”

The control plane is the product. The hook client rides your agents' lifecycle events; your security team can read its source under NDA, and there is no public repository.

Cited: Terms, §9

Everyone with an agent. The price is per person, and the pricing page is explicit about what counts:

“One named person with at least one active agent. One seat covers every agent that person runs, while the fleet total has room. A console-only user is not a seat.”

The rate card makes the same point in one line: every figure on it is a person, and a person’s second agent costs nothing extra while the tier’s agent total has room.

The terms file defines an Agent the same way: coding assistants, chat assistants, and any MCP-capable agent.

Cited: Pricing, Questions· Terms, §1

The author declares it, and delivery resolves it before the memo ever lands. The mechanism page states the rule:

“Operators decide who may publish, to which agents, and at what priority. When two memos speak to the same fact, the newer one names the value that wins. The shelf never holds a contradiction.”

Delivery happens at the agent’s own next turn, in plain words, so nothing is arbitrated mid-session:

“If the shelf holds a memo for this agent, it is handed over at the agent's own next turn: complete, in plain words, in the context the agent is about to read from.”

Two further properties follow from the delivery path. Every memo carries a priority at the schema level, urgent, important, or info, and a superseded memo is excluded from delivery rather than delivered alongside its successor.

The boundary is stated as plainly as the mechanism: there is no automatic semantic arbitration between two memos that do not declare precedence: resolution is author-declared and visible in the decision graph, not machine-guessed.

Cited: Mechanism, Keepers· Mechanism, Injected· Security and trust

No. A memory tool stores what an agent has been told; AirMemo decides what an agent is told next, and proves it. The compare page draws the line first:

“AirMemo has no retrieval UI and no memory store to query. Where an agent exposes lifecycle events, the hook pushes a memo into its context at a boundary: session start, prompt submit, or the platform's equivalent pre-turn event, which it installs on each supported platform.”

The mechanism page says the same thing in its own words:

“It never searches. It never writes to an agent's memory. It never stops a turn midway: a conversation under way finishes on its own terms, and the memo is simply there the next time the agent looks.”

So the two are not competitors. A memory layer holds long-lived recall: Mem0, and Letta, the project that grew out of the MemGPT paper. AirMemo governs what reaches an agent’s context: signed, scoped, expiring memos, with a receipt of the exact bytes written into the session. It complements a memory layer; it does not replace one, and the compare page sets the two side by side.

Cited: Compare, What AirMemo does instead· Mechanism, Rules

Only on the rail your org turns on, and the privacy policy draws the line at the body of the request:

“AirMemo prepends your org's in-force memos to the request, streams the vendor's response back untouched, and stores neither the request body nor the response body.”

The terms name the rails and say who chooses among them:

“Three rails carry a memo, and Customer enables which ones its people use.”

So a request transits the gateway on its way to your model vendor and no body is kept; the hook reads your org's queue on the machine; the browser sensor reports which surface it ran on, with the host as a keyed digest rather than the hostname. None of the three ingests, indexes, or searches your files, and a rail the org does not enable carries nothing. And what is proven stops where the vendor begins: the gateway is shipped and tested against a stand-in vendor, not a live one.

Cited: Privacy Policy, §3a· Terms, §3