Your memory, owned by you: how Almond handles security, isolation and BYO LLM

Almond positions itself as the World's First Agentic Brain for Autonomous Performance Marketing. The more context an AI system holds about your business, the more the security model matters. This article explains exactly how Almond is built to protect that context, written for the security reviewer who needs specifics and the agency founder who needs to answer a client asking "where does our data go?"

What Almond actually holds

Before covering the controls, it helps to be precise about what the system ingests. Almond connects to Google Ads, Meta, Slack, Notion, Google Sheets, email, meeting recordings and CRM data in read-only mode. The connection takes roughly four minutes. Once connected, the Business Context Engine continuously captures tests, results, decisions and strategy calls, classifies them by relevance, recency and business impact, and retains them in a versioned context store.

That is a meaningful surface area. Meeting recordings contain client strategy. Slack threads contain pricing discussions. CRM data contains revenue figures. The security architecture has to match the sensitivity of what it holds.

Your data is never used to train models

Almond's context is never used to train its models or anyone else's. This is not a setting you have to find in a privacy dashboard. It is a design constraint, not a policy preference.

This matters because the default data handling of many AI tools, particularly those built on top of large model APIs, can be ambiguous. Some providers use inputs to improve models unless you opt out. Some contracts require you to read the enterprise addendum carefully before you can be sure. Almond's position is direct: your context is yours, it does not feed back into any training pipeline, and that applies whether you are a solo media buyer or a 50-person agency.

Context is never pooled across customers

Every context store is isolated per client and per team at the data layer, not at the prompt layer.

That distinction is worth slowing down on. A prompt-layer isolation means the system instructs the model to only use context from a given client. A data-layer isolation means the context for Client A is physically separated from the context for Client B, so the model never has access to both at the same time regardless of how a prompt is constructed.

For an agency founder, this has a direct practical implication. If you manage 20 accounts inside Almond, a recommendation generated for a retail brand cannot surface data from a financial services client. That is enforced at the architecture level. You do not need to trust that a prompt was written carefully enough.

Bring your own LLM

Almond supports bring your own LLM (BYO LLM), meaning you can run the agents on models your security team has already reviewed and approved.

This matters in two situations. First, if your organization has signed a data processing agreement with a specific model provider, for example a private deployment of a major model or an enterprise agreement with usage restrictions, you can route Almond's agent calls through that model rather than a default. Second, if your client contracts restrict which third-party AI services can process their data, BYO LLM gives you a path to compliance without losing the functionality.

The practical effect is that your business context, the meetings, decisions and test histories that Almond holds, never crosses a model boundary that your security or legal team has not already approved.

Versioned and auditable context

Every piece of context inside Almond is versioned. That means when something goes wrong, and in any system something eventually goes wrong, you can answer the two questions that matter most in a post-incident review: what did the agent know, and when did it know it?

Versioning also protects against a subtler problem. Context drifts. A budget decision made in January gets superseded in March. A campaign that was paused gets reactivated. Without versioning, an AI system can act on stale context confidently, with no signal to the user that the underlying information is outdated. With versioned context, you have a timestamped record of what state the system was in when a recommendation was generated.

For agencies that need to document decisions for client reporting or compliance purposes, the audit trail is not an add-on. It is built into how the context store works.

Encryption in transit and at rest

Almond encrypts data both in transit and at rest. This is a baseline expectation for any system handling business-sensitive data, and it is worth confirming explicitly rather than assuming. Data moving between your connected sources and Almond's context store is encrypted in transit. Data stored in the context store is encrypted at rest.

Role-based access

Not everyone on a team needs access to every client's context. Role-based access controls let you define who can read, configure or modify context at the team and client level.

For an agency, this typically means account managers can access the context stores for their own accounts, senior strategists can access a broader portfolio view, and client contacts, if given any access at all, see only their own data. The controls are enforced at the system level, not managed through shared login credentials or folder permissions in a connected workspace.

Export and deletion rights

You can export or delete your context whenever you want. If you decide to stop using Almond, you take your data with you. If a client ends their engagement and asks you to confirm their data has been removed, you can do that.

This is not a complicated process by design. Portability and deletion rights are increasingly a contractual requirement in agency agreements, particularly for clients in regulated industries. Having a clear answer to "can we get our data out?" and "can we confirm it's deleted?" matters when you are negotiating a new contract or responding to a client's security questionnaire.

What this looks like for a security reviewer

If you are the person at an agency or a brand responsible for reviewing new tools before they go to procurement, here is a summary of the controls described above:

• No model training on customer data
• No cross-customer data pooling, isolated at the data layer
• BYO LLM support for routing through approved model providers
• Versioned context with a full audit trail
• Encryption in transit and at rest
• Role-based access at the team and client level
• Export and deletion available on request

Almond connects to your sources in read-only mode. It does not write to your ad accounts, CRM or any other connected system. The context engine reads and classifies. The products built on top of it, Canvas, Workflow Builder and the Integrations layer, are where actions happen, and those operate under the same context isolation model.

What this looks like for an agency founder

The client question you are most likely to face is not a technical one. It is: "You're putting our strategy, our meeting recordings and our performance data into an AI. Where does that go?"

The answer Almond gives you is concrete. Their data stays in their context store. It does not touch another client's store. It does not feed a shared model. If they want it deleted, it gets deleted. If your security team has a preferred model provider, you can use that provider.

That is a different answer from "our AI is secure" or "we take privacy seriously." It is specific enough to put in a client-facing security addendum.

There is also a competitive angle here that is easy to miss. Your accumulated context, nine years of test results, account decisions and strategic reasoning across your client portfolio, is your actual product. If that context lives in a system that pools it or uses it to improve a shared model, you are subsidizing a competitor's training data. The isolation model means that what your agency learns stays inside your agency.

Where Almond fits

Almond (almond.ai) is an early-stage startup. Early access is open, and every member gets a 1:1 Meta and Google ad account audit with the CEO, recorded. The waitlist requires a work email.

If you are evaluating Almond from a security standpoint, the architecture described here is what to verify in your review. The controls are not positioned as enterprise add-ons. They are described as design decisions made from the first line of code. That is worth confirming directly with the team during your audit conversation.