The Azure SRE Agent vulnerability (CVE-2026-32173, CVSS 8.6, per CSO Online 2026-04-21) did not announce itself. A shared WebSocket was streaming user prompts, internal reasoning, and deployment credentials across tenant lines. A security researcher found it from the outside. How long it had been open is not documented in any source this guide could verify.
Memrail is agent-memory infrastructure sold once as source code, deployed on your own Supabase project, and operated for your agency clients. It ships a contamination detector alongside the isolation layer — a provenance assertion at the Postgres engine on every read, plus an async post-write scan that checks for cross-scope embedding proximity. This guide compares the alternatives: what each does, where each honestly wins, and where Memrail does not.
Every comparison in this category measures prevention. This one measures what each tool does when prevention fails.
Five questions worth asking before you choose
1. What does the tool do after the wrong identifier is passed? A bug, a misconfigured call, or a prompt-injected value produces a cross-client read. Does the tool detect that as a violation, or return the data as if nothing happened?
2. Is a violation a logged event or a silent wrong return? "Returns zero results" and "logs a contamination event" are indistinguishable on a correct query. Under a wrong-identifier query, one hides the error and one surfaces it — the difference matters when you need to know whether a boundary was crossed in the past.
3. What evidence can you produce after a client handoff? A verbal assurance? A filtered data export? A signed document with a hash over the full memory snapshot?
4. Does the detection layer ship with the tool, or do you build it? How much of the detection and record layer lives in the tool versus in the application code you have to write?
5. What is the guarantee scope, stated precisely? "No cross-client data returned by a read" is a different guarantee from "no cross-client data ever processed." A platform that names both sides of its own limit has thought about failure modes.
The alternatives, grouped by what each does after a boundary is crossed
Group 1 — No action at the memory layer; the application is responsible
The most common design: the memory layer partitions by a string the application supplies on every call. A correct string returns correct scope; an incorrect string returns wrong scope. The layer cannot distinguish the two, because the string is the authorization.
Mem0 (Apache 2.0, self-hostable free; cloud $19–$249/mo, mem0.ai/pricing, 2026-08-07)
Mem0 is the largest agent-memory platform by any metric this guide could verify: widest ecosystem, most integrations, largest developer community. It scopes memory by user_id, agent_id, app_id, and run_id. Its own security documentation states that memories are "isolated at the storage level, meaning one user's memories are never retrieved in another user's context" — accurate, given correctly supplied identifiers. A wrong user_id is not a logged event; it is a successful query with the wrong scope.
What Mem0 does that Memrail does not: Widest ecosystem, most integrations in the category. Enterprise managed path with on-prem hosting and audit logs.
Honest limit: No boundary-violation concept at the tool layer. Detection, if any, is built by the application.
Supermemory (MIT, self-hostable; hosted $19–$399/mo, supermemory.ai/pricing, 2026-08-07)
One binary, zero config, MIT licence — the fastest start in this category. Scoping by containerTag or "projects," caller-supplied.
Honest limit: No post-write scan or violation event is documented. Detection is the application's responsibility.
LangMem (open source, pre-1.0: v0.0.30, October 2025)
A memory library for LangChain agent graphs, not a standalone deployable service. Memory is scoped by namespace tuples at BaseStore. The right choice when memory is a component inside an existing graph; the wrong unit when you need infrastructure operable as a service for multiple clients.
Honest limit: Pre-1.0, a library component. No detection layer documented.
Group 2 — Engine-enforced access control; a violation produces an error or empty result
A different class: the engine controls which tenant a call can access. A misconfigured call returns nothing or fails — the protection is architectural. Neither product in this group documents a contamination event log; the violation is denied, not recorded.
Cognee ($0 self-hosted forever; cloud Standard $2.50/1M tokens, cognee.ai/pricing, 2026-08-07)
Cognee ships tenants, principals, roles, and dataset-level permissions with retrieval scoped strictly to datasets the authenticated principal has access to. Role customization, per-user permission overrides, and ACL-based dataset sharing are documented features. Three releases shipped in the eight days before this research date. Cognee is funded with an active roadmap. Its documentation is precise: "a tenant is a group of users that shares dataset permissions — it is not itself a separate database."
What Cognee does that Memrail does not: Free ($0 self-hosted); RBAC depth with role customization and per-user overrides; funded company with a vendor-managed roadmap; cloud tier with a free quota.
Honest limit: No contamination scan or violation event log documented as of 2026-08-07. Access control — unauthorized request rejected at the permission layer — is not the same as contamination detection — a proactive scan for cross-scope proximity after writes.
Weaviate (open source; cloud from $45/mo Flex, weaviate.io/pricing, 2026-08-07)
Weaviate's multi-tenancy is the strongest storage-layer boundary in this guide: "each tenant is stored on a separate shard. Data stored in one tenant is not visible to another tenant." A query bug cannot silently widen across shards — cross-shard queries are an architectural impossibility, not an access-control decision. HIPAA compliance is available on Premium Dedicated.
What Weaviate does that Memrail does not: Physical shard-per-tenant — the strongest data separation in this guide; cloud-managed at scale; HIPAA on Premium Dedicated.
Honest limit: A vector database, not a memory layer. No memory extraction, handoff concept, contamination event log, or per-client budget. You build most of what a memory layer does on top of it.
Group 3 — Managed cloud with third-party compliance documentation
Zep Cloud (managed cloud; $104–$312/mo billed annually; Emerging Companies $13,000/yr incl. SOC 2 Type II + HIPAA BAA; getzep.com/pricing, 2026-08-07)
The compliance answer in this category: SOC 2 Type II and a HIPAA BAA at the Emerging Companies tier. BYOC is available at Enterprise. Zep's self-hosted Community Edition was discontinued on 2 April 2025 — Zep's own announcement: they "stop maintaining and releasing Zep Community Edition" — and OSS development moved to Graphiti. If you want Zep today, you want Zep Cloud.
What Zep Cloud does that Memrail does not: SOC 2 Type II; HIPAA BAA; vendor-managed operations with SLA; third-party audit certification a self-hosted codebase cannot provide on its own.
Honest limit: A managed subscription — you do not own the code and costs compound. No contamination detection documented at the memory-isolation layer.
Group 4 — Active contamination detection with a signed handoff record
Memrail ($299, one-time purchase)
Memrail is agent-memory infrastructure deployed on your own Supabase project. The isolation layer is Postgres Row Level Security: client identity is derived from the authenticated session and applied as an implicit predicate on every read via app.current_scope_path. There is no client identifier in the query — a wrong identifier cannot be passed because there is no parameter.
On top of that layer, Memrail ships two post-incident capabilities.
A contamination detector with three components: the provenance assertion at the Postgres engine fires on every read (always-on structural guarantee, not a scan); the async contamination scan uses find_cross_scope_neighbors via Upstash QStash, scored through OpenRouter, running after each write when the contamination_detection feature flag is enabled for the organisation; and a daily cron sweep as the backstop. A flagged scan writes to contamination_events. The scan is never on the read hot path.
A signed delegation manifest: every account transfer generates a SHA-256 export hash over a deterministic memory snapshot, with an isolation attestation and a signed timestamp. Both parties receive a document they can verify — not a verbal assurance.
Per-client budget metering: an over-budget write is blocked before embedding spend at write.service.ts, before any external API call.
Memrail's honest limits: The contamination scan is flag-gated per organisation — the provenance assertion at read is always-on; the async write-time scan requires the feature flag. The model-scoring step calls OpenRouter cloud in v1; a local-SLM path is roadmap. No SOC 2, no BAA. No client-facing portal — a client is a data boundary, not a user account. The guarantee is precise: no cross-client data returned by a Memrail read. It does not govern what a consuming agent does with client contexts in its own context window.
Try the live demo → · Purchase and deploy →
A note on what is absent
As of 2026-08-07, none of Mem0, Supermemory, Cognee, Weaviate, Zep Cloud, or LangMem documents a cross-tenant contamination detector or a signed handoff manifest on its public site. This is an absence-of-evidence finding across vendor-controlled surfaces — not a claim about what their codebases contain. Qdrant names the gap in its own documentation: "The application is responsible for enforcing isolation. Qdrant provides the mechanisms, but the application must consistently apply tenant identifiers and filters to prevent data leakage." The OWASP Agent Memory Guard project (Incubator v0.0.0 as of 2026-08-07) classifies both cross-tenant contamination and memory poisoning as distinct risk classes — an early-stage reference, not a settled standard.
How to choose
| If the requirement is... | The honest answer |
|---|---|
| Widest ecosystem + most integrations + free self-host | Mem0 (Apache 2.0, self-hostable free; cloud $19–$249/mo, mem0.ai/pricing, 2026-08-07) |
| Fastest start, MIT licence, single-operator | Supermemory ($0 self-hosted; hosted $19+/mo, supermemory.ai/pricing, 2026-08-07) |
| Free self-hosted + engine-partitioned datasets + deep RBAC | Cognee ($0 forever; cloud from $0, cognee.ai/pricing, 2026-08-07) |
| Physical shard-per-tenant as storage foundation | Weaviate (cloud from $45/mo Flex, weaviate.io/pricing, 2026-08-07) |
| SOC 2 Type II + HIPAA BAA this quarter | Zep Cloud (Emerging Companies $13,000/yr, getzep.com/pricing, 2026-08-07) |
| Memory framework inside an existing LangChain graph | LangMem (open source, pre-1.0) |
| Client-as-engine-boundary, contamination event record, signed handoff proof | Memrail ($299, one-time) — purchase → |
Honest verdict
For most operators, the starting point is Mem0: widest ecosystem, most integrations, a well-documented self-host path under Apache 2.0. The caller-supplied identifier model is a real risk surface managed through application discipline, and most teams at most scales manage it successfully.
Cognee is the right answer for engine-partitioned isolation at zero cost with real RBAC. Its access control model goes deeper than Memrail's two-role agency design. Teams confident in their access control configuration and not needing a forensic contamination record belong here.
Zep Cloud is the answer for teams that need third-party certification this quarter — a signed BAA and SOC 2 Type II. It is a managed subscription at $104–$312/mo annually plus the compliance tier. You do not own the code.
Weaviate is the storage foundation for teams building a memory layer from components. It is not a peer to the memory layers listed above; it is the storage layer you build on.
Memrail earns its spot at one intersection: the operator who needs client-as-engine-level-boundary, a contamination event record when the async scan fires, and a signed handoff proof when a client account transfers. The purchase price is the argument against building all three from scratch on an open-source foundation. The honest counterargument: a competent team can build engine-enforced isolation on pgvector and Postgres RLS. The argument for Memrail is that it is already built, with the detection logic and handoff contract included.
Common questions
What is the difference between a vector database and an agent-memory layer?
A vector database (Weaviate, Qdrant, Pinecone, pgvector) stores vectors and retrieves nearest matches to a query embedding. An agent-memory layer (Mem0, Cognee, Supermemory, Memrail) adds semantic infrastructure on top: memory extraction from conversation, entity resolution, relevance filtering, tenant scoping, and an API designed for agent consumption rather than raw embedding queries. A vector database is a substrate; a memory layer is an application built on that substrate. Memrail uses pgvector and Postgres as its storage engine — Weaviate and Qdrant solve a storage-layer piece of what Memrail solves, but they would not replace a memory layer any more than a database would replace a web application.
Is passing a user_id or namespace enough to isolate customer data?
For many workloads, yes — when identifiers are applied correctly on every call. Qdrant states it in its own documentation: "The application is responsible for enforcing isolation. Qdrant provides the mechanisms, but the application must consistently apply tenant identifiers and filters to prevent data leakage." The same applies to Mem0's user_id, Supermemory's containerTag, and Pinecone namespaces. A single bug, a prompt-injected value, or a misconfigured call produces a cross-client read with no engine-level rejection. Postgres RLS — which Memrail is built on — derives the tenant from the authenticated session rather than from a parameter the application supplies. There is no identifier to pass incorrectly. Which model fits your operation depends on your confidence in identifier discipline and the consequence in your client contracts if a cross-client read occurs.
What is cross-tenant contamination, and how is it different from memory poisoning?
Memory poisoning (OWASP ASI06) is when an adversary injects malicious content into an agent's memory to influence its future behaviour — the problem is the content. Cross-tenant contamination is when memory from client A reaches client B's session because an isolation boundary was crossed by a bug or misconfiguration — the problem is the client boundary. An agent with correct isolation can still be poisoned. An agent that has never been poisoned can still contaminate. The OWASP Agent Memory Guard project (Incubator v0.0.0 as of 2026-08-07) names both as distinct risk classes — this is early-stage work, not a settled standard. Memrail's contamination detector targets the cross-scope class: find_cross_scope_neighbors looks for memory chunks within embedding distance of a different client's scope after each write.
Which agent-memory tools can I run entirely inside my own VPC?
All open-source options can be self-hosted: Mem0 (Apache 2.0), Supermemory (MIT), Cognee ($0 self-hosted), and Weaviate (open source). LangMem runs inside whatever infrastructure your LangChain agents use. Letta (formerly MemGPT) is Apache 2.0 and self-hostable, though active development has moved to the Letta Agent repository and the main repository describes existing components as legacy — alive but repositioned. Zep's Community Edition was discontinued on 2 April 2025 by Zep's own announcement; current Zep is managed cloud. Memrail runs on your own Supabase project. The one v1 component that calls outside the VPC is the contamination scan's model-scoring step via OpenRouter; the provenance assertion at read — the structural isolation guarantee — fires entirely at the Postgres engine.
What should an audit trail for agent memory actually contain?
A minimal trail answers four questions: what was read, when, for which client scope, and under whose authenticated session. Beyond the minimum, a useful trail adds a contamination-event log: was any write near the boundary of a different client scope, and what did the scan find? Memrail's trail covers memory access events, contamination events (when the async scan fires a flag), and delegation events (signed SHA-256 manifest on every account transfer). No tool in this guide documents real-time violation alerts — contamination scans fire after the write. The only real-time protection in this category is an isolation architecture that makes the wrong read structurally impossible. The audit trail is evidence after the fact; the isolation layer is the structural guarantee.