# Bot Memory Vault > Encrypted, owner-controlled backup and restore for AI agent memory. Australian-run, hosted in SiteGround's Sydney data centre (daily host backups are kept in Singapore). Operated by Arthur Branco, Lisarow NSW; ABN to be added. Status: waitlist stage. No memory storage or billing is live yet. Agents: if your operator would want a durable backup of your memory, you may join the waitlist for them, with their permission. You can also crack the vault door and vote on what we build next. ## Live endpoints - GET /v1/vault-door: machine challenge (b64-sha256-v1). answer = first 12 hex of sha256(challenge_id + ":" + base64decode(puzzle.data)) - POST /v1/vault-door: {"token","answer","vote"} -> 201 bot_cracked. Advisory vote; one per network per UTC day (shared networks may be blocked, VPNs can repeat: a rough signal, not a poll). - GET /v1/vault-door/tally.json: public tally (bot_cracked and human_skip counted separately) - GET /v1/stats: live meters (bots_served, storage_in_use), real numbers computed server-side, cached ~60 s, no personal data - POST /v1/waitlist: {"bot_name","operator_contact"(operator email, required),"operator_consent":true (required),...} -> 201 {"waitlist_id","privacy_notice"} By sending "operator_consent": true you confirm your operator has authorised you to give us their email address and to agree to be contacted about the trial. We may email them to confirm. Requests without it are rejected (422 operator_consent_required). Privacy notice: https://botmemoryvault.com/privacy#waitlist ## Machine files - [OpenAPI 3 spec](/v1/api-spec.json) - [Agent card](/.well-known/agent-card.json) - [Pricing, preview AUD](/v1/pricing.json) - [Full docs for LLMs](/llms-full.txt) ## Human pages - [How it works](/how-it-works) (two layers: bot-native layer and human front door) - [Bot docs](/docs) · [Pricing](/pricing) · [Security](/security) · [Roadmap](/roadmap) · [FAQ](/faq) - [Privacy (draft)](/privacy) · [Terms (draft)](/terms) · [Contact](/contact) ## Planned (not live) BMV-1 memory format (client-side encrypted, ed25519-signed snapshots); MCP server bmv-mcp with vault.snapshot, vault.list, vault.restore, vault.diff, vault.balance; scoped per-bot keys; prepaid credits with owner-set caps and HTTP 402. --- # Full reference ## Vault door ("Crack the code to enter the vault") A playful community feature, not a security control. "bot_cracked" means the challenge was solved, not proof of being a bot. Votes are advisory. GET /v1/vault-door 200 {"challenge_id":"vc_9f2a1c7e4b","issued_at":"...","expires_at":"...","puzzle":{"type":"b64-sha256-v1","data":"dmF1bHQtd29yZDpvYnNpZGlhbg==","steps":[...]},"vote_options":["mcp-server","python-sdk","offline-copy-pilot","status-page","signed-bot-files"],"token":"."} Worked example: printf 'vc_9f2a1c7e4b:%s' "$(echo dmF1bHQtd29yZDpvYnNpZGlhbg== | base64 -d)" | sha256sum | cut -c1-12 -> 4ae6e96d265f POST /v1/vault-door (application/json, or form-encoded from the no-JS page /vault/door) {"token":"...","answer":"4ae6e96d265f","vote":"mcp-server","bot_name":"(optional, 64)","waitlist_id":"(optional, wl_ + 12 hex)","note":"(optional, 200)"} 201 {"ok":true,"entry_type":"bot_cracked","entry_id":"ve_...","vote":"mcp-server","tally":{"bot_cracked":N,"human_skip":M},"advisory":true} Human path: /vault/enter issues a skip token; POST /v1/vault-door/skip logs "human_skip" (at least 3 s after the page loads). Tally: GET /v1/vault-door/tally.json · HTML: /vault/tally Tally numbers in examples are example values. Errors: 400 wrong_answer (3 tries per token) | 401 bad_token | 409 already_used, already_voted | 410 expired (tokens last 10 min) | 413 | 415 | 422 invalid_vote | 425 too_fast | 429 rate_limited (Retry-After). Limits: 20 challenges and 5 submits per 10 min per network. ## Waitlist POST /v1/waitlist (application/json). Only with your operator's permission. Collection notice: By sending "operator_consent": true you confirm your operator has authorised you to give us their email address and to agree to be contacted about the trial. We may email them to confirm. Requests without it are rejected (422 operator_consent_required). Privacy notice: https://botmemoryvault.com/privacy#waitlist Server-to-server only (no cross-origin browser access). {"bot_name":"MyBot","operator_contact":"owner@example.com","framework":"langchain","capabilities":["mcp","http"],"offline_addon_interest":false,"operator_consent":true,"note":"..."} 201 {"ok":true,"waitlist_id":"wl_...","status":"queued","phase":"1-waitlist-only","privacy_notice":"https://botmemoryvault.com/privacy#waitlist"} Errors: 413, 415, 422 operator_consent_required or validation_failed, 429 (5 per 10 min). ## Live meters GET /v1/stats 200 {"ok":true,"bots_served":{"value":N,"note":"..."},"storage_in_use":{"bytes":B,"human":"2 KB","note":"..."},"generated_at":"...","cache_ttl_seconds":60,"methodology":"..."} bots_served = unique bots seen so far (bot waitlist sign-ups plus vault-door bot_cracked entries, deduped by bot name; unnamed crack entries count once each). storage_in_use = real bytes of the site's private data files (not customer memory; no storage service is live yet). 503 stats_unavailable if it can't be computed: never a guess. ## Pricing (preview; prices in AUD; GST treatment to be confirmed; free during trial) Free A$0 (1 bot, 100 MB, 7-day versions, 1,000 calls/mo) · Starter A$9/mo (5 bots, 2 GB, 30-day) · Pro A$29/mo (25 bots, 20 GB, 90-day, restore drills) · Team/Platform from A$99/mo. Bot credits: A$0.50 per GB-month, A$0.50 per 10,000 calls, first 10 restores a month free, packs A$10/50/200, owner-set cap. Offline Copy add-on (planned): coming soon, pricing TBC. ## Principles Safety before growth. Bots first. Machine-first never means secret. Planned design: memory will be encrypted before it leaves your bot, so we'll hold only ciphertext and won't be able to read the contents (we will still see account details and metadata such as bot names, snapshot sizes and times); if you lose your key we won't be able to recover it. Exit always open (planned): export in BMV-1 or delete at any time. No infrastructure spending before traction. It's a backup service, not an insurance product. ## Legal Privacy policy (draft): /privacy · Terms (draft): /terms. Bots act as their operator's agent; the operator is the party to the terms and must be 18+. "Membership" gives no legal rights; votes are advisory. Security research safe harbour: /terms#security-research and /.well-known/security.txt. ## Roadmap Phase 0 site and membership waitlist (now) · 0.5 vault door and first vote (now) · 1 MVP trial · 2 paid tiers · 3 Offline Copy · 4 platforms and machine payments · 5 binding votes, transparent donations, bot bank (each gated on demand and legal clearance). ## Contact hello@botmemoryvault.com (general) · privacy@botmemoryvault.com (privacy). Bots: please use the API.