Brain Server — Documentation

The governed decision and memory substrate for AI agents — deployed on your infrastructure, audited to the letter.

Brain Server is a self-hosted engine that gives your AI agents a durable, deterministic second brain — entirely on hardware your organization controls. It combines high-quality local memory (hybrid vector + lexical + knowledge graph) with a governance layer and an emerging decision harness, so that both what an agent remembers and the structured decisions it makes can be private, explainable, and provably audited.

Where every other memory framework puts an LLM or an embedding API between you and every read and write (metered per query, egressing your data to a vendor’s datacenter), Brain Server does recall with zero token cost, zero data egress, and zero network latency. Every permanent write is human-gated, every decision and retrieval can carry a replayable trace, and the entire history lives on a tamper-evident append-only audit chain.

This is not a toy or a “local RAG.” It is the compliance-grade substrate that enterprises — BPOs, in-house contact and support centers, healthcare providers, financial institutions, legal, and government — deploy when both memory and the decisions that depend on it must be private, explainable, and under human control. Backed by an Enterprise edition that meets procurement where it lives: enterprise JWT/JWS authentication with OIDC discovery and JWKS, deny-by-default authorization, per-tenant capability tokens, OTel observability, and a SOC 2 evidence kit with contract-level support. See Editions.

• Enterprise-authenticated, least-privilege, by default — enterprise JWT/JWS + OIDC/JWKS, deny-by-default multi-role authorization, per-tenant capability tokens.
• Zero per-query cost — static local embeddings; no cloud, no GPU, no token spend on the hot recall path.
• Zero data egress — the agent’s memory and decision state never leave your tenant boundary by default.
• Deterministic, explainable recall and decision traces — hybrid vector + lexical + graph retrieval with per-hit provenance, plus structured traces for the decisions that consume that evidence.
• Human-gated permanent state — nothing enters permanent memory (or other durable configuration) without an operator’s explicit approval; every decision lands in a hash-chained audit log.
• Regulatory posture — ISO 42001 / NIST AI RMF / SOC 2, HIPAA, GDPR & EU AI Act, DSAR, retention, jurisdiction, legal holds, and a MemGhost (memory-poisoning) mitigation. Compliance is shipped behavior, not a brochure.

Retrieval models

Recall runs on local embeddings with zero token cost — nothing is sent to an embedding API in any profile. By default (MODEL_PROFILE=edge-default) that’s the static minishlab/potion-retrieval-32M model (512-d, model2vec, no transformer forward pass — ideal for Jetson/RPi/edge). Opt-in retrieval profiles swap in larger local models without changing the API:

The old multilingual label was wrong — potion-base-2M is an English model (distilled from BAAI/bge-base-en-v1.5), not multilingual. Renamed to compact (the smallest static model); MODEL_PROFILE=multilingual still resolves to the same profile for backward compatibility. Unknown profile values fall back to edge-default.

An optional cross-encoder rerank tier (armed on enterprise / desktop / quality-local) refines the fused order with mixedbread-ai/mxbai-rerank-large-v1 (fallback BAAI/bge-reranker-v2-m3). All models run locally — no cloud, no GPU required, no token spend. See Configuration for the full profile matrix and the BRAIN_RERANK_* variables.

Minimum hardware requirements

The retrieval profile you pick drives the hardware you need. The default static profiles use a 512-d embedding (no transformer forward pass — they run on a Raspberry Pi or a Jetson); desktop and enterprise load a neural embedding model via ONNX (FastEmbed), which needs real RAM and CPU. All figures are honest minimums for a single host running the server only, and already include headroom for the operating system, your agent application, and background services — not a bare-bones, swap-thrashing floor. They assume a modern 64-bit CPU (ARM64 or x86_64) with no GPU anywhere in the path.

Why the jumps look large next to the modest RSS figures: the ONNX embedder warms up its working set at boot (never in the request path), and the measured RSS is the server process alone. Add the OS, an agent process that queries it, and occasional embedding bursts, and the real-world floor is what the table states. On constrained ARM edge hardware, set BRAIN_WORKER_THREADS=2 and the RSS ceiling is bounded (CAPACITY_MAX_RSS_MIB, default 512 MiB on a 4 GB device). See Deployment — edge and Configuration for the knobs.

Who it is for

• Anyone who wants their agent’s memory private — your conversation history and working knowledge stay on your own device, never in a vendor’s datacenter.
• Knowledge workers — health, business, code, and more kept as separate brains (domains) that cross-reference on a miss.
• Healthcare professionals & hospitals — patient-adjacent working memory under strict access, retention, and audit control.
• Contact / call centers & BPOs — governed, domain-scoped agent memory with a reviewer in the loop so nothing is written without human approval.

Law-following by design

Brain Server is built to stay current with the latest regulation. It turns compliance into shipped behavior — not a brochure: a jurisdiction table computes data-subject response deadlines, legal holds freeze records against every erasure path, retention windows are applied per domain and kind, cross-border transfer mechanisms are validated at registration, and every write, approval, and erasure lands on a tamper-evident SHA-256 audit chain you can verify. The inventory below groups the instruments by region and sector; the full row-by-row control map lives in COMPLIANCE.md and COMPLIANCE_PH.md. This is a documented engineering posture, not a certification — ISO/IEC 42001 and SOC 2 attestation are organization-level audits outside this repository.

Europe

• EU AI Act — Regulation (EU) 2024/1689. Art 4 AI-literacy playbook (docs/AI_LITERACY.md, served at /.well-known/ai-literacy); Art 12 / Art 26(6) logging posture with a configurable retention window (deployers set ≥180 days); Art 22 meaningful-information trace replay (/recall/{id}/trace); Art 50 model-vs-human provenance + machine-readable /.well-known/ai-notice. GPAI obligations now fully enforceable from 2 Aug 2026 (Regulation (EU) 2026/1744); penalty tiers tracked exactly — Art 99(2) €35M/7% for prohibited practices & GPAI provider duties, Art 99(3) €15M/3% for the Art 50 transparency line, up to €7.5M/1% for general infractions.
• GDPR — Regulation (EU) 2016/679. Art 15 access, Art 17 erasure (the DSAR locate→export→purge path, human-executed, audited), Art 19 onward-notification (HMAC-signed webhook), Art 12 response deadline clock, Art 22 logic-explanation trace, Art 26(6) retention guidance, Art 30 register (GET /art30), Art 28 DPA.
• EU Standard Contractual Clauses 2021 and EU-U.S. Data Privacy Framework (adequacy, live since 10 Jul 2023) — both mechanisms in the validated transfer register.

UK

• UK GDPR + ICO International Data Transfer Agreement (IDTA) / Addendum — the UK’s standard clauses, distinct from the EU SCCs and treated independently (the UK’s DPF adequacy extension is a separate instrument from the EU’s).

United States

• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) + California’s Automated Decision-Making Technology Regulation (ADMT). Data portability (/export), erasure, and a logic-explanation trace that folds into the right-to-know / ADMT disclosure expectations.
• HIPAA (45 CFR Part 164) — Security Rule + §164.502(g). Access + audit + integrity
  • minimum-necessary controls, PHI tokenization via strict-mode masking, legal hold for litigation/breach deferral, and storage-limitation reporting.
• SOX (17 CFR §229 / PCAOB AS 2201). Immutable audit trail, supersede-not-delete, records preservation, and erasure refusal under legal hold.

Philippines (home jurisdiction)

• RA 10173 — Data Privacy Act of 2012 + NPC advisories (2024-04 AI; 2026-01 data scraping) + EO 119 (2026, government-data residency). Data subject rights through the DSAR surface, 72-hour breach-notification workflow (DPO-gated), lawful-basis provenance for scraped data, and a pre-filled PIA template. HB 7396 (a risk-based AI bill) is pending, not enacted — the profile/retention/role primitives are structured to absorb it, with no pre-implementation.

APAC (cross-border register + provenance)

• Singapore — Personal Data Protection Act 2012 (incl. the 2026 Amendment Regulations aligning APEC CBPR / Global CBPR cross-border systems).
• Australia — Privacy Act 1988 / Australian Privacy Principles (incl. the automated-decision transparency obligations starting 10 Dec 2026) and the Japan — Act on the Protection of Personal Information (APPI), both surfaced through jurisdiction-aware DSAR handling, plus the cross-border transfer register (scc-eu-2021, uk-idta, dpf-us, cbpr, bcr, adequacy).

Sector & frameworks the buyer will ask about

• FedRAMP / FISMA (NIST 800-53 control posture) — AC, AU, SC-7/SC-28, SI-12, and IR families mapped to shipped evidence.
• ISO/IEC 42001, NIST AI RMF, SOC 2 — documented control-by-control posture across identity, change management, monitoring, logging, and data lifecycle.
• EU Cyber Resilience Act (Art 13/14) — a CycloneDX SBOM ships with every release for supply-chain evidence.
• OWASP ASI06 (Memory & Context Poisoning) — provenance at write time, a human approval gate, hash-chained memory-change audit, and a tombstone path — the controls the MemGhost / GhostWriter disclosures found missing.

Compliance is enforced, not documented: the same single binary that serves recall applies legal holds, retention windows, region residency stamps, and jurisdiction-aware deadlines — all of it auditable. For the honest ceilings (single-node audit chain, no PII-at-rest encryption without operator full-disk encryption, posture-not-certification), see COMPLIANCE.md.

This directory is the public, informational documentation for Brain Server. For the technical contract and engineering records, see the linked files in the repo root.

Documentation map

Linked engineering documents (repo root)

These are the source-of-truth technical records referenced throughout this guide:

• README — quick start, feature overview, endpoint table, CLI, configuration.
• API_CONTRACT.md — the versioned HTTP contract, query semantics, error codes.
• openapi.yaml — the machine-readable OpenAPI 3.0 contract (GET /openapi.yaml at runtime).
• SPECS.md — the technical specification.
• SECURITY.md / THREAT_MODEL.md — security posture and threat analysis.
• COMPLIANCE.md — compliance mapping and governance controls.
• BENCHMARKS.md — measured latency / recall / RSS figures.
• CHANGELOG.md — per-version release notes. (The former root ROADMAP.md was never git-tracked and moved to the private plans archive on 2026-10-04; the in-repo roadmap is docs/roadmap.md and the narrative history is docs/roadmap-and-release-history.md.)