---
slug: what-to-store
title: "What you may store (security and limits)"
description: "It's an outside service and what you store stays. The do-not-store list, where responsibility sits, and the domains an IT admin blocks."
lang: en
---


# What you may store (security and limits)

This may be the most important page in this guide. It starts with one sentence:

> **AiAkiv is an outside service, sitting outside your company, and what you
> store stays there permanently and searchably. That makes "what you store" a
> security question.**

## AiAkiv is not a file locker (again)

Nailing down again what [What AiAkiv is](what-is-aiakiv) said. AiAkiv
**remembers what happened and why**: decisions and context. **It is not a place
to upload whole original documents.** Keep that distinction and most security
incidents never happen in the first place.

- Good: "We chose session cookies for auth. Reason: XSS defense. JWT was
  rejected."
- Risky: pasting in an internal design doc, a source file, or a customer list
  wholesale.

### The best use: keep the material elsewhere, only the relationships here

Leave originals where they belong and keep **only the relationships and context
between them** in AiAkiv:

- Code in **GitHub**, and the **process and decisions that produced it** in
  AiAkiv.
- Files in **your drive**, and a **summary of each file** in AiAkiv.
- **The conversation with the AI itself.**

That way the original system keeps the original secure, and AiAkiv remembers
only why things ended up this way.

## What not to store

Especially in a **company or organizational setting**, keep these out.

- **Company confidential material or original internal documents**: specs, full
  source, internal metrics.
- **Third-party confidential information (including your employer's)**:
  anything you have **no legal right** to store.
- **Personal data (PII)**: real names, contact details, national ID numbers.
  Other people's above all.
- **Secrets**: API keys, tokens, passwords, certificates.

## What AiAkiv can and cannot do (where responsibility sits)

Drawing the line honestly.

- **What it cannot do:** AiAkiv (or the AI inside it) **cannot determine
  whether you have the right to store a piece of text.** Reword it and any
  automatic detection is bypassed. So the service **does not promise** to prevent
  leaks at the source.
- **Your part (and your company's):** deciding what to store and following your
  company's policy is the responsibility of the user and their organization. →
  the terms clause below.
- **The controls AiAkiv does provide:**
  - **Cooperation on blocking**: **every service domain is published** so a
    company can block them, down to which domain actually carries data (see *For
    IT administrators* below).
  - **Refusing to store secrets**: obvious secret patterns (key- and token-shaped
    strings) are rejected on save.
  - (Enterprise) approved-organization-accounts-only, SSO, audit logs, and IP
    allowlists are available on organizational adoption.

## The terms clause (in substance)

> Users store **only content they have the legal right to store.** Responsibility
> for storing a third party's confidential information (including an employer's)
> without authorization **lies with the user.**

The exact wording is in the [Terms of Service](https://www.aiakiv.com/terms).

## If you handle company material

**Check your company's security policy before storing company material.** If
you're not sure, don't. Storing company confidential material in a personal
account is usually a policy violation, and the responsibility comes back to you.

## For IT administrators: how to block it

To stop employees in your organization from using AiAkiv, **block the domains at
your network, proxy, or CASB**. There are four service domains, and they do
different things.

| Domain | What it is | Effect of blocking |
|---|---|---|
| **`mcp.aiakiv.com`** | **Where the AI attaches: all saving and searching flows through here** | **Blocking this alone stops data from leaving** |
| `app.aiakiv.com` | The console (team and project management) | Blocks setup and administration |
| `www.aiakiv.com` | Marketing and setup instructions | Blocks the information pages |
| `card.aiakiv.com` | Public card pages → [Cards](cards) | Blocks viewing cards |

**If you block only one thing, block `mcp.aiakiv.com`.** The other three are read
and admin screens; no data passes through them. Conversely, blocking only the
console while leaving this one open **is not a block at all**: AI clients save
without ever touching the console.

For managed adoption (approved organization accounts only, audit logs, SSO, IP
allowlists), contact us at support@aiakiv.com.

## Next

- Saving conventions (what to leave, and how) → [Saving](saving)
- Who can see what inside a team (the permission boundary) → [Team sharing](sharing)