# MnemoShare — Full Product Specification

> MnemoShare is an enterprise-grade managed file transfer (MFT) platform that replaces legacy SFTP servers and MFT appliances with identity-bound, ephemeral file exchange built for zero trust. Designed for healthcare, financial services, and other regulated industries.

## The Problem

Legacy file transfer is the most exploited infrastructure in regulated industries. The breach record proves it:

- **MOVEit Transfer (CVE-2023-34362)**: SQL injection in a monolithic web application. 2,600+ organizations compromised. Estimated $10B+ in total costs. Root cause: a decades-old architecture that exposed a web interface with direct database access and no application-layer segmentation.
- **GoAnywhere MFT (CVE-2023-0669)**: Pre-authentication remote code execution via exposed admin console. 130+ organizations compromised. Root cause: administrative interfaces accessible without authentication on a monolithic appliance.
- **Accellion FTA (CVE-2021-27101/27102/27103/27104)**: Chain of four vulnerabilities in a 20-year-old codebase. SQL injection, OS command execution, SSRF, and arbitrary file write. Root cause: legacy code that was never designed for modern threat models.
- **SFTP credential compromise (systemic)**: SSH key sprawl across organizations. Keys never rotated, shared among teams, leaked in source repositories, and inherited by departing employees. Not a single CVE — a systemic design flaw.

Every one of these breaches traces to architectural decisions that MnemoShare was built to prevent: static credentials, monolithic attack surfaces, no content inspection, and audit trails that don't survive investigation.

## Architecture

MnemoShare is a cloud-native platform built in Go, deployed as a single multi-binary Docker image on Kubernetes.

### Core Components

- **API server**: Go REST API handling file operations, authentication, encryption, and compliance controls
- **Workflow worker**: Async job processor for multi-step file processing pipelines
- **Email gateway**: Inbound/outbound email protection with DLP and policy enforcement (Postfix integration)
- **MCP server**: 220+ tools for AI-guided configuration, migrations, workflow creation, and full admin integration (Claude, GPT, etc.)
- **CLI (mnemocli)**: Cross-platform command-line client (Homebrew, APT, Chocolatey)
- **MnemoZilla**: Desktop client built with Tauri/Rust for cross-platform file transfers
- **Migration parsers**: Purpose-built tools for MOVEit, GoAnywhere, Kiteworks, and GlobalScape

### Deployment Models

**Self-hosted**: Deploy on your own Kubernetes cluster via Helm charts (available on Artifact Hub). You control your infrastructure, encryption keys, identity provider, and data. Full operational independence from MnemoShare.

**SaaS (managed cloud)**: Dedicated, isolated instance per customer on MnemoShare-managed Kubernetes. Each customer gets their own namespace, database, S3 storage, and encryption keys. No shared tenancy. Same security architecture as self-hosted. 7-day free trial on all SaaS tiers.

Both models share the same codebase, the same security controls, and the same audit capabilities.

## Security Architecture

### Identity-First Access Control

MnemoShare treats identity as the primary security boundary — not IP addresses, network location, or inherited trust.

- **Ephemeral credentials**: Short-lived JWTs replace permanent SSH keys and service account passwords. Credentials expire automatically. Nothing to rotate, revoke, or forget.
- **SSO integration**: OIDC and SAML 2.0 support for Azure AD, Okta, Ping, Google, Keycloak, and other providers.
- **MFA enforcement**: TOTP-based multi-factor authentication with backup codes. Enforceable for all users without exceptions.
- **Hardware mTLS (Enterprise+)**: Optional mutual TLS with non-exportable private keys bound to YubiKey PIV, Apple Secure Enclave, or TPM 2.0 via Step-CA certificate authority. NIST 800-63B AAL3 compliant.
- **Role-based permissions**: Fine-grained access control with per-collection scoping and domain whitelisting for trusted partners.

### Encryption

- **In transit**: TLS 1.3 with strong cipher suites
- **At rest**: AES-256-GCM with per-file keys and customer-controlled key management
- **End-to-end**: Optional client-side encryption mode
- **Integrity**: SHA-256 checksums for all files
- **Key distinction**: Data-at-rest encryption keys are customer-controlled at all license tiers. HSMs are used for identity/authentication keys (mTLS), not bulk data encryption.

### Data Isolation

- Per-organization S3 bucket isolation — no shared storage
- Per-customer database in SaaS deployments
- Per-customer Kubernetes namespace in SaaS deployments
- No vendor access to customer data by default

## Features

### Workflow Automation (Business+ and higher)

Orchestrate multi-step file processing pipelines with a visual drag-and-drop builder or custom code execution.

**No-code workflows**: 13 built-in step types including detect file type, unarchive, upload to MnemoShare, upload to remote (SFTP/FTPS/Rsync), generate download links, set retention, send email, call webhook/API, and conditional branching. Cron-based scheduling and manual triggers. Template system (Go templates) for dynamic field values. Error handling per step. Real-time transfer dashboard.

**Custom code execution**: Sandboxed Kubernetes namespace for script execution with full isolation, resource limits, and RBAC. Write scripts, push to GitHub, and MnemoShare pulls and runs them against workflow-populated files. Build ETL pipelines. Same audit trail and compliance controls as no-code workflows.

### DLP & Content Intelligence

Multi-stage detection pipeline: pattern matching flags potential sensitive data, ML models score confidence, optional GenAI integration (Anthropic/OpenAI) for high-accuracy classification. Coverage across PHI, PII, PCI, secrets, infrastructure, and regulatory categories. Confidence scoring with post-match validation (e.g., Luhn algorithm for credit cards). Filename scanning. Policy actions: log, warn, or block. Automatic masking of findings in logs and alerts.

### Email Security Gateway

Inbound gateway (Postfix socketmap + content filter) and outbound relay with policy enforcement. Multi-format scanning: plain text, Office docs, PDFs. Policy actions: pass, reject, or rewrite (redact body, extract attachments to secure links, or hybrid). Per-domain configuration. Configurable size limits.

### Anomaly Detection

Behavioral analytics that learn normal usage patterns and flag deviations. User behavioral baselines learned over time. Peer group comparison for insider threat detection. Time-weighted risk scoring (off-hours, weekends). Velocity, volume, and time anomalies. Automated security alerts with admin notification.

### Content Scanning & Quarantine

Real-time malware scanning via ClamAV/ICAP integration. YARA rules support for custom signatures. Multi-format extraction (Office, PDF, archives). Auto-quarantine with admin review workflow.

### Audit & Compliance

Immutable structured event logs covering 30+ event types. SIEM export to Splunk, Datadog, and other platforms. WORM storage support via S3 Object Lock for tamper-evident retention. HITRUST r2 assessment in progress. Supports HIPAA, SOC 2, ISO 27001, and NIST CSF controls. Configurable retention from 90 days to 7+ years.

### Dynamic Q&A Validation

Configurable questionnaires presented at point of file access. Verify recipient identity, authorization, and purpose before allowing download. Responses captured in audit trail.

### Migration Tooling

Purpose-built migration parsers for legacy MFT systems:
- **MOVEit**: User, folder, permission, and transfer history migration
- **GoAnywhere**: Project, workflow, and user migration
- **Kiteworks**: Folder structure, user, and permission migration
- **GlobalScape**: User, virtual folder, and event rule migration

Incremental migration supported — move sensitive flows first, decommission legacy infrastructure over time.

### MCP Server (AI Integration)

220+ tools exposed via Model Context Protocol for AI assistant integration. Covers full admin surface: user and organization management, file operations, folder permissions, DLP policy configuration, audit log queries, compliance checks, anomaly alerts, workflow creation and management, email filtering, forms, reports, API keys, hardware device management, webhooks, notifications, templates, security settings, system diagnostics, and infrastructure status. AI-guided migration from legacy MFT systems and AI-assisted workflow creation. Compatible with Claude, GPT, and any MCP-compatible AI assistant.

### REST API & CLI

Full REST API with granular permissions (upload, download, manage_folders, read_audit, manage_users). Cross-platform CLI (mnemocli) available via Homebrew, APT, and Chocolatey.

## Competitor Comparison

| Capability | SFTP | MOVEit | GoAnywhere | MnemoShare |
|---|---|---|---|---|
| Authentication | SSH keys / passwords | Local + LDAP | Local + LDAP | SSO + MFA + ephemeral JWTs + hardware mTLS |
| Credential lifespan | Permanent | Permanent | Permanent | Ephemeral (auto-expires) |
| Encryption at rest | Disk-level (if configured) | AES-256 | AES-128/256 | AES-256-GCM per-file, customer-controlled keys |
| DLP / content inspection | None | Limited | Limited | Multi-stage (pattern + ML + GenAI) |
| Workflow automation | None | Basic scheduling | Workflow engine | Visual builder + sandboxed custom code |
| Email gateway | None | None | None | Inbound/outbound with DLP + policy |
| Anomaly detection | None | None | None | Behavioral analytics + peer comparison |
| Audit trail | Server logs | Database logs | Database logs | Immutable, WORM-exportable, SIEM-integrated |
| Hardware identity | None | None | None | YubiKey, Secure Enclave, TPM 2.0 via mTLS |
| AI integration | None | None | None | MCP server (220+ tools) |
| Migration tooling | N/A | N/A | N/A | Built-in parsers for MOVEit, GoAnywhere, Kiteworks, GlobalScape |
| Deployment | Server | Appliance/Cloud | Appliance/Cloud | Kubernetes-native (self-hosted or managed SaaS) |
| Architecture | Monolithic daemon | Monolithic web app | Monolithic web app | Cloud-native microservices |

## Pricing

### SaaS (per seat, billed monthly/quarterly/annually)

- **Team**: $15/seat/month, 5-25 seats. Core file transfer, DLP, content scanning, audit logging.
- **Business**: $25/seat/month, 10-100 seats. Adds SSO, enhanced DLP, API access, custom branding.
- **Business+**: $45/seat/month, 25-250 seats. Adds workflow automation, SIEM export, advanced anomaly detection.
- **Enterprise**: $65/seat/month, 50+ seats. Adds hardware mTLS, extended audit retention, dedicated support.

All SaaS tiers include 7-day free trial. Discounts available on quarterly and annual billing cycles. Optional add-on features available on each tier for additional capabilities.

**HIPAA BAA**: Available on any SaaS tier for $100/month, plus required compliance upgrades (e.g., 6-year audit retention, SIEM storage audit log export).

### Self-Hosted

- **Pilot**: $9,000/year. 1-year evaluation license with limited scope. Designed for proof-of-concept and initial validation.
- **Governed**: $36,000/year. Full compliance controls including SIEM export, extended audit retention, partner organization support, and federated SSO.
- **Enterprise SXC**: Contact sales for pricing. Options and pricing depend on scale, integration requirements, and support needs.
- **Regulated**: Contact sales for pricing. FIPS 140-3, custom compliance requirements, source code access under NDA. Pricing dependent on options.

### Add-Ons (available on applicable tiers)

HIPAA BAA, SIEM export, audit retention extensions, custom branding, dedicated support, hardware mTLS, workflow automation, email gateway, migration tooling, MCP server access, advanced DLP, anomaly detection.

## Compliance & Certifications

- **HITRUST r2**: Assessment in progress
- **HIPAA**: BAA available, full technical safeguard coverage
- **SOC 2**: Control mappings provided, supports Type II audit
- **ISO 27001**: Aligned controls for information security management
- **NIST CSF**: Mapped to Cybersecurity Framework categories
- **FIPS 140-3**: Ready — all cryptographic operations (AES-256-GCM encryption, TLS, key management, hashing, signing) designed for FIPS 140-3 validated modules

## Technical Details

- **Language**: Go (backend), React 19 + TypeScript (frontend), Rust (desktop client)
- **Database**: MongoDB
- **Storage**: S3-compatible (AWS S3, MinIO, DigitalOcean Spaces)
- **Orchestration**: Kubernetes with Helm charts
- **Certificate Authority**: Step-CA for mTLS
- **Job Queue**: Redis Sentinel for workflow coordination
- **Container Registry**: Docker Hub (production releases, signed), GHCR (development)
- **Helm Repository**: Artifact Hub (https://artifacthub.io — search "mnemoshare")

## Company

MnemoShare is built by engineers with 35+ years of combined experience in enterprise security, regulated file transfer, and breach response across healthcare and financial services. Every architectural decision traces to a failure mode witnessed in production environments.

## Links

- Website: https://mnemoshare.com
- Features Overview: https://mnemoshare.com/features
- Workflow Automation: https://mnemoshare.com/features/workflow-automation
- DLP & Content Intelligence: https://mnemoshare.com/features/dlp
- Email Security Gateway: https://mnemoshare.com/features/email-security
- Anomaly Detection: https://mnemoshare.com/features/anomaly-detection
- Content Scanning & Quarantine: https://mnemoshare.com/features/content-scanning
- Identity & Access Control: https://mnemoshare.com/features/identity-access
- Audit & Compliance: https://mnemoshare.com/features/audit-compliance
- Migration & Integration: https://mnemoshare.com/features/migration
- AI Integration (MCP Server): https://mnemoshare.com/features/ai-integration
- Security: https://mnemoshare.com/security
- SFTP Replacement: https://mnemoshare.com/sftp-replacement
- Self-Hosted Pricing: https://mnemoshare.com/pricing
- SaaS Pricing: https://mnemoshare.com/pricing/saas
- Documentation: https://mnemoshare.com/docs
- About: https://mnemoshare.com/about
- Contact: https://mnemoshare.com/contact
- Support: https://mnemoshare.com/support
- Knowledge Base: https://mnemoshare.com/kb
- Helm Charts: https://artifacthub.io (search "mnemoshare")
- X (Twitter): https://x.com/MnemoShare
- LinkedIn: https://www.linkedin.com/company/mnemoshare/
- GitHub: https://github.com/MnemoShare