Private memory stays inside. Context only crosses to a model when a user or policy approves it. Every crossing is logged, audited, and provable.
Retrieve and approve context inside the boundary. Only what you choose crosses to a provider — and every crossing comes with proof.
Upload documents. Kavacha extracts text, detects and redacts PII — names become [PERSON_1] — and indexes chunks into private memory.
Ask a question. Kavacha searches memory with hybrid keyword + semantic search and surfaces relevant snippets — entirely inside the private boundary. Nothing has left yet.
You see exactly what was found. A user or release policy chooses which snippets may cross to the AI provider. Unapproved snippets stay inside — always.
Only approved, redacted snippets are sent. The answer comes back with a full proof: retrieved vs. sent vs. blocked, token count, cost, model, and who approved.
Every ingestion, retrieval, approval, and provider call is logged immutably. Filterable by user, project, provider, date, and cost. Export-ready for compliance.
For anyone using public AI with private data — clinicians, compliance officers, business owners, and the teams that build for them. No technical background required.
Document storage, search, and retrieval run entirely within your deployment. Queries never leave your infrastructure during retrieval — nothing crosses until you say so.
No context is sent to a provider automatically. Every snippet requires explicit approval — from a user or from a release policy you configure per project.
Names, invoice IDs, product names, companies, and account numbers are replaced with lookup codes — [PRODUCT_X], [COMPANY_1]. When the AI answers, Kavacha swaps every code back so you read fully resynthesized results with real names and values.
Every answer links to a proof screen: retrieved vs. sent vs. blocked, token breakdown, cost estimate, model, and who approved the release — immutably recorded.
A full log of every operation — filterable by user, project, provider, action, date, and cost. Append-only. Export-ready for compliance and legal review.
One memory API. OpenAI, Anthropic, Gemini, and local models all work the same way. Swap providers without changing how memory or release policies work.
Kavacha exposes a standard MCP server. Register your app, drop in your key, and your AI has private memory with the release gate already enforced — server-side, before any context surfaces.
// claude_desktop_config.json (or any MCP-compatible agent) { "mcpServers": { "kavacha": { "url": "https://mcp.trykavacha.com/ws/your-workspace-id", "headers": { "Authorization": "Bearer kv_live_xxxxxxxxxxxx" } } } } // That's it. Your AI now has private memory with a release gate. // No SDK. No preview/send dance. No REST endpoints to wire up.
V1 focuses on the control teams understand immediately: retrieve privately, inspect risk, approve release, and keep proof of exactly what crossed.
For repeated-query privacy, Kavacha is grounded in the Private-RAG paper (arxiv 2511.07637). Its MURAG and MURAG-ADA algorithms assign each chunk a privacy budget that depletes as it is retrieved over time — a formal differential privacy guarantee across all queries, not just per query.
That research path becomes the advanced privacy layer in V2: budget-aware retrieval, noisy thresholds, and Rényi DP accounting for sensitive corpora.
MURAG / MURAG-ADA (arxiv 2511.07637) — Multi-Query Retrieval-Augmented Generation with Differential Privacy. For any two corpora differing by one chunk, the probability of retrieving any context set differs by at most e^ε.
Retrieve and show snippets. Nothing is ever sent to external providers. Answers use local models only. Maximum isolation.
Retrieve snippets privately. A user inspects and approves each snippet individually before it crosses to the provider.
A release policy auto-approves safe snippets, flags ambiguous ones for human review, and blocks prohibited entity types from crossing to external providers.
Formal DP retrieval. Laplace noise on scores, fixed threshold T, per-chunk privacy budget depletion across all queries.
Adaptive per-query threshold. Better privacy/utility tradeoff on repeated queries over sensitive corpora.
Self-hosted. MIT license. One docker compose up to run it yourself.