Security Architecture

MemorDesk implements several non-obvious security patterns that go beyond standard SaaS practices. This article documents them for security-conscious teams.

Dead Refresh Token Circuit Breaker

Most web apps retry on a 401 Unauthorized response. When an authentication session is invalidated (rotated, revoked, or expired), retrying produces a cascade of 401s that each trigger another refresh attempt -- creating a request storm and often causing rate-limit errors.

MemorDesk's session management layer detects the specific error conditions that indicate a token is permanently invalid. On any of these, it immediately clears all session cookies and redirects to the sign-in page. There is no retry. The rate-limit storm never starts.

Password Forensics Without Plaintext

MemorDesk's intrusion log captures failed login attempts for analysis, but plaintext passwords are never stored -- not even temporarily.

When a failed login is recorded, a salted, non-reversible fingerprint is derived from the attempted password and the plaintext is discarded immediately. Only a fragment of that fingerprint is kept, which is deliberately too little to reconstruct the password even in principle.

It is enough to recognise that the same credential was tried against many accounts, which is what identifies a credential-stuffing campaign, and not enough to learn what the credential was.

Credit Holds for Concurrent Execution Safety

Credits are MemorDesk's billing unit for AI operations (meeting processing, Kojo queries, voice recaps). A naive deduction model has a race condition: two simultaneous jobs both read the user's balance as sufficient, both proceed, and the user ends up overdrawn.

MemorDesk solves this with a credit hold pattern borrowed from payment processing:

1. Before starting a job, a temporary reservation is placed against the expected credit cost with an automatic expiration window.
2. Credit availability checks include active holds in the balance calculation.
3. On job completion, the hold is consumed and the actual deduction is recorded in the immutable transaction ledger.
4. On job failure, the hold is released. Credits are never deducted for failed jobs.
5. Expired holds collapse automatically, providing a safety valve if a job hangs indefinitely.

Desktop: profile avatar (top-right) > the credit balance dropdown shows your available balance net of holds.

Mobile: profile avatar (top-left) > Profile > Credits card.

Shared Bot Session Deduplication (Team+ Plans)

When two calendar events in the same organization share the same meeting URL, a naive system would send two bots -- one per event. This causes two identical bots to appear in the meeting simultaneously, wasting provider cost and confusing participants.

MemorDesk's calendar ingestion engine checks for an existing active bot session matching a meeting URL before dispatching a new one. If a bot is already in the session, the second event is attached to the same session rather than triggering a new join.

This deduplication is active for Team, Business, and Enterprise plans.

Intrusion Detection and Observe Mode

MemorDesk records rejected authentication attempts with the network and device telemetry needed to recognise an attack, alongside the non-reversible fingerprint described above. Automated rules evaluate those attempts and can block sources of repeated failures, and raise an alert when a single account is targeted from many directions at once.

The specific rules, thresholds and enforcement posture are not published, for the obvious reason.

Administrative Access Control

Administrative functions are separated from the product surface and protected independently of it.

• Access can be restricted to an approved set of network locations, and the restriction fails closed: once a restriction exists, anything outside it is refused.
• Refused requests are given a response that does not confirm the administrative surface exists at all.
• Holding a valid MemorDesk account is not sufficient. Administrative privilege is a separate grant, checked on every request, and can be revoked immediately.

These controls are independent, so no single one of them failing grants access.

Session and Device Tracking

Every authenticated device is registered with its device fingerprint, platform, OS, IP address, user agent, and last-seen timestamp. Administrators can revoke any device session remotely.

Desktop: Settings > Security (/dashboard/settings/security) > active sessions list.

Mobile: profile avatar (top-left) > Profile > scroll to Sessions.