Free starts on device
Local memory and local evidence stay on the user's computer unless a cloud feature is explicitly configured.
Trust
Local-first by default. Governed when AI work becomes shared.
HeapFile separates local memory, account membership, product-owned connectors, mobile handoff, and organization controls. That keeps Free useful while making Premium cloud, data-center, and team features explicit.
Server-side gates
Desktop UI can explain tiers, but Premium cloud services must enforce paid access at their own server boundary.
Authorized evidence
GitHub, AWS, Microsoft, Atlassian, and future connectors should use HeapFile-owned authorization flows and customer scopes.
Compute is not context
Bring your own inference through Ollama, NIM, vLLM, hosted APIs, or enterprise stacks. HeapFile preserves the sourced memory, approval boundary, and evidence trail around them.
Enterprise checklist
What organizations can ask for before a rollout.
For enterprise buyers, be ready to discuss tenant isolation, retention, export and deletion, support contacts, incident response, audit logs, DPA path, deployment boundaries, and the private security review packet. HeapFile does not claim compliance certifications that have not been independently completed.
- Data boundary. Identify what stays local and what syncs to cloud.
- Access boundary. Confirm account roles, connector scopes, and admin controls.
- Operational boundary. Confirm support owner, incident path, and rollback plan.
- Legal boundary. Prepare privacy, terms, DPA/security review, and retention answers without claiming formal compliance certification before review.
Privacy notice
Read the privacy notice for local-first defaults, account data, support handling, and optional cloud features.
Retention, export, delete
Read the data-control answers before putting organization data into cloud-backed features.
Questionnaire path
Use the security-review answer set to scope organization use and review capability boundaries.