Rights and contracts
AI agent memory stores: are they licensable records, and whose?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
AI agent memory is the persistent store an agent writes so it can recall users, past work and rules across sessions: extracted user facts, preferences, conversation summaries, episodic logs of past actions, embeddings and learned instructions. It is a business record the deploying company usually controls, but most of it is personal data derived from someone else's words. Only de-identified, purpose-compatible memory with clear contract rights can join a licensed dataset.
Key takeaways
- AI agent memory is ordinary stored data, such as facts, preferences, summaries, action logs, embeddings and self-edited instructions, so it is a business record with an owner and a retention clock.
- The deploying company usually controls the store, but control is separate from privacy permission, contract rights and the right to license.
- Deleting a chat often leaves its memories behind, and expiration flags or version histories can keep records you thought were gone.
- User profiles, embeddings and caches are rarely licensable; episodic logs of agent work on your own systems and policy-only procedural memory are the realistic candidates.
- Strip identifiers, customer-confidential content, deleted or expired memories, vectors and secrets from any extract, and have counsel review the specific contracts.
What is AI agent memory, as a business record?#
AI agent memory is any information an agent stores outside a single model call so it can use it again later: in the next turn, the next session, or for a different user. Unlike the model's weights, memory is ordinary data sitting in a database, a vector index or a folder of files, which makes it a business record your company can be asked to retain, produce, delete or explain.
Framework documentation splits it two ways. LangGraph separates short-term memory, the thread-scoped conversation state persisted by a checkpointer, from long-term memory, which is saved under custom namespaces and recalled across threads. It also borrows three content types from cognitive science: semantic memory (facts about a user), episodic memory (past agent actions) and procedural memory (instructions such as the system prompt).
The record question matters because memory is written by a model, not typed by a clerk. A line such as 'User prefers email follow-ups' is an inference the agent drew from a conversation, stored with identifiers that tie it back to a person, an account and a session. Treat it like any other derived customer record: it has a source, a subject, a purpose and a retention clock.
What does an agent memory store actually contain?#
A production memory store usually holds six kinds of record, and they carry very different risk. Inventory them before anyone asks whether the store is an asset.
- User facts and profiles: extracted statements such as job title, location, account tier or the systems a customer uses. Mem0, for example, stores extracted memories rather than a verbatim transcript by default, turning 'I prefer aisle seats' into 'User prefers aisle seats'.
- Preferences: tone, channel, format and scheduling choices the agent should honor next time.
- Conversation summaries and thread state: rolling summaries or the full message history of a session, persisted so a later turn can resume it.
- Episodic logs: records of what the agent did on past tasks, often reused as few-shot examples of how to do a task correctly.
- Embeddings and entity links: vectors computed from memory text for similarity search, plus extracted people, organizations and relationships.
- Procedural memory and caches: instructions the agent rewrote for itself after feedback, and cached tool results such as a CRM lookup or an order status.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Where does agent memory live in common tools?#
In almost every case, agent memory lives in storage the deploying company runs or rents, not inside the model. The table summarizes what the official documentation of five common memory layers says about where records sit and who can remove them.
| Memory layer | Where records live | Deletion and retention controls | Record implication |
|---|---|---|---|
| Claude memory tool (API) | Files under a /memories path that your application maps to its own storage; operations run client-side | Your handler deletes files; docs suggest validation that strips sensitive data and periodically deleting files not accessed in a long time | Fully your record, in your infrastructure, under your retention policy |
| Mem0 (Platform or open source) | SQL database for facts and metadata, vector database for embeddings, entity store; scoped by user_id, agent_id, app_id and run_id | Delete by ID, batch delete up to 1,000, delete_all by filter; expiration dates hide but do not delete | Facts are model-extracted summaries; scoping IDs make per-person deletion possible, and Platform offers filtered, schema-based export |
| LangGraph | Checkpointer database for thread state; a store with namespaces for long-term memory | Whatever your configured database supports; memory writes can run in the hot path or in the background | Conversation history and long-term facts are separate records with separate clocks |
| OpenAI Agents SDK sessions | Conversation history in a session backend such as SQLite, Redis, SQLAlchemy databases, or server-managed OpenAI Conversations | clear_session and pop_item remove history; an encrypted session wrapper adds encryption and TTL expiry | The backend you choose decides who holds the history and how it expires |
| Letta Code (from the creators of MemGPT) | Memory blocks and other agent context, tracked via git in Letta Code; Letta Cloud can store memory, identity and conversations | Memory import and export remain supported; because context is tracked via git, earlier versions may persist | Version history may mean old memory content persists after an edit |
Who owns AI agent memory: the company, the vendor or the user?#
The deploying company usually controls agent memory, but control is not the same as an unrestricted right to reuse it. Four permissions apply to any memory record: access to the store, privacy permission from the people it describes, contract rights, and the right to license. Answering one does not answer the others, and the full framework is in the guide to data privacy and the right to license business records.
Access is the easy part. For a self-built agent on the Claude memory tool, Mem0 open source or LangGraph, you control and can delete the records. For workforce assistants it can be split: Anthropic's help center says that on Claude Team and Enterprise plans owners control whether memory is available, but owners cannot view or edit a user's individual memories.
Privacy and contract limits then apply. The GDPR's purpose limitation principle (Article 5(1)(b)) restricts reusing personal data collected for another purpose, and a preference stored to personalize support was not collected to train someone else's model. Memory about a customer's staff may also be that customer's confidential information under your agreement, and the FTC has warned that model-as-a-service companies that break promises not to use customer data for purposes such as training may face liability under the laws it enforces.
Memory is derived from content other people supplied, so a license is only as good as the rights in that underlying content. De-identification reduces privacy risk; it does not create a right to license.
How long is agent memory kept, and does deleting a chat delete it?#
Agent memory is often kept longer than the conversation that produced it, and deleting the chat frequently does not delete the memory. Your retention schedule needs a separate line for memory stores.
Consumer assistants show the pattern. Anthropic says deleting a Claude conversation does not automatically remove memory entries generated from it, and that turning memory off for an organization deletes existing entries immediately. OpenAI's help center says ChatGPT saved memories are stored separately from chat history, that deleting a chat does not delete a saved memory, and that logs of deleted saved memories may be retained for up to 30 days for safety and debugging.
Developer frameworks leave retention to you. Mem0's expiration date hides a memory from search after the date passes, but the record stays in storage and is still returned when fetched by ID. LangGraph and the OpenAI Agents SDK keep history in whichever database you configure until you clear it.
Copies kept for convenience are where storage limits fail. In the Digi case (C-77/21), the EU Court of Justice held that keeping personal data in a test database longer than the testing required breached the storage limitation principle, and that the controller must be able to show data are kept only as long as necessary. Memory snapshots, exports for evaluation and git histories of memory files are the same kind of copy.
Memory-store record triage table: what could be licensed#
Classify each memory type on five points before anyone exports it: what it holds, where its content came from, whether it is personal data, who agreed to the original use, and whether it could be licensed. The table is a starting position for counsel and a data owner, not a decision; contract terms can move any row.
| Memory type | Source of the content | Personal data status | Licensable? |
|---|---|---|---|
| User fact or profile (role, location, account tier) | Model extraction from a user's own messages | Personal data; directly tied to a user ID | No as stored; at most aggregate counts after review |
| Preference (channel, tone, format) | User statement or inferred behavior | Personal data while keyed to a person | After redaction, only as de-linked preference patterns with no user keys |
| Conversation summary or thread state | Customer and staff messages plus model replies | Personal data and often confidential customer content | After redaction, only where the underlying transcripts are themselves licensable |
| Episodic log of past agent actions | Agent tool calls, results and outcomes on real tasks | Mixed; record IDs and names appear in arguments and results | Often the most useful type; after redaction and with system-owner rights |
| Embeddings and entity graph | Computed from memory text | Treat as personal data; research shows text can be partly recovered from embeddings | No; re-derive from approved text instead of shipping vectors |
| Procedural memory (self-edited instructions) | Agent rewrite based on staff feedback | Usually low; may quote internal policies | Yes, if it holds only your own policies and no customer text |
| Tool result cache (CRM lookup, order status) | Copies of system-of-record data | Same status as the source system | No from the cache; license from the source system with its own rights review |
| Memory change history and versions | Prior values of edited or deleted memories | Can contain data a user asked you to delete | No; purge and exclude from any extract |
What should you strip before agent memory leaves the company?#
Strip identity keys, other people's content and anything a user asked to forget before memory leaves the store for any secondary use. Use this checklist on the extract, not on the live store.
- Scoping identifiers: user_id, account, tenant, app and session IDs, or replace them with keys that cannot be reversed outside your company.
- Direct identifiers inside memory text: names, emails, phone numbers, addresses, order and ticket numbers, and free-text quotes of what a person said.
- Customer-confidential content: anything your agent learned while working inside a customer's environment, unless that customer's contract permits the use.
- Deleted, expired or superseded memories: expiration flags, soft deletes and version history are not deletion, so filter them out explicitly.
- Embeddings and caches: drop vectors and cached tool results and keep only reviewed text and outcomes.
- Sensitive categories: health, financial account, biometric, children's and government ID data, which need separate legal review even after redaction.
- Secrets: API keys, credentials and internal URLs that agents sometimes store as 'useful facts'; Mem0's own guidance is to avoid storing secrets and unredacted sensitive data in memory at all.
How is agent memory different from transcripts, trajectories and RAG corpora?#
Memory is the agent's own distilled, persistent and editable notes; transcripts and trajectories are the raw record of what happened. That difference changes the rights analysis, because memory is one more step removed from the people who supplied the content and is rewritten over time.
If your question is whether the conversation records themselves can be licensed, start with the guides on AI support agent transcripts and on your own chatbot transcripts. If you need the format of a full action record, the comparison of agent trajectories and workflow logs covers it. Vendor training on deployment logs, and personal data inside retrieval corpora, each have their own guide linked below.
This page owns a narrower question: once an agent has condensed those interactions into memory, is that store a record you can export or license, and what must be removed first. In practice the answer is usually to license the underlying, rights-reviewed records and treat memory as a pointer to what is valuable, not as the deliverable.
When do memory records belong in a licensed dataset?#
Memory records belong in a licensed dataset only when the underlying records are yours to license, the new use is compatible with why they were collected, and the extract has been de-identified and reviewed. Episodic logs of agent actions on your own operational systems, and procedural memory built from your own policies, are the strongest candidates; user profiles and embeddings almost never are.
SourceX is the enterprise data transaction layer for AI: it runs sourcing and qualification, rights review, contracting, data preparation, delivery and payment for businesses licensing operational data to AI developers. The company approves exactly what is released, once per deal, and sees what would leave before anything is shared. Under standing offer terms, de-identification is performed by SourceX directly or through its processing partner.
Buyers generally look for years of consistent history, typically two or more, and tens of thousands of records or more in one system, which is why the system-of-record history behind an agent usually matters more than the memory store itself. The first step is a short company assessment, and no data uploads are needed to see if a company qualifies.
Frequently asked questions
What is AI agent memory?
AI agent memory is information an agent saves outside a single model call so it can use it later, such as user facts, preferences, conversation summaries, logs of past actions and learned instructions. It lives in ordinary storage like a database, vector index or file folder. That makes it a business record with an owner, a purpose and a retention period.
Who owns the data in an AI agent's memory?
The company that deploys the agent usually controls the storage, but the content is derived from what users and customers said, so their privacy rights and your contracts still apply. Control lets you read and delete memory; it does not by itself give you a right to license it. Counsel should review the specific contracts and notices.
Does deleting a conversation delete the agent's memory of it?
Often not. Anthropic and OpenAI both document that deleting a chat does not automatically delete memories generated from it, and developer frameworks keep memory until your code removes it. Delete memory entries, their versions and any exports separately.
Can AI agent memory be used to train or fine-tune a model?
Only if the people and customers whose content it reflects allowed that use, or another lawful basis and your contracts cover it, and after the extract is de-identified. Most memory records are personal data collected to personalize a service, which is a different purpose. Episodic logs of agent actions on your own systems are the most realistic candidates.
Is a vector memory store personal data?
Treat it as personal data when the source text was. Embeddings are computed from the memory text, published research shows the text can be partly recovered from them, and memory records are usually keyed to a user ID. Re-derive vectors from approved text rather than sharing an existing index.
Should agent memory have its own retention schedule?
Yes. Memory outlives the sessions that created it, and features such as expiration flags may hide records without deleting them. Give memory stores, their version history and their exports a named owner and a deletion rule of their own.
Sources
- LangGraph distinguishes thread-scoped short-term memory persisted by a checkpointer from long-term memory stored in namespaces across threads, and maps semantic, episodic and procedural memory to agent facts, past actions and instructions. Source
- Mem0 stores extracted memories rather than a verbatim transcript by default, keeps facts and metadata in a SQL database, embeddings in a vector database and entities in an entity store, and advises against storing secrets or unredacted sensitive data. Source
- Mem0 scopes memories by user_id, agent_id, app_id and run_id to keep users, agents and sessions separate and to control data retention. Source
- A Mem0 expiration date hides a memory from search and listing after the date passes but does not delete it; fetching by ID still returns it. Source
- Mem0 supports deleting a single memory, batch deletion of up to 1,000 memories, and filter-based deletion by user, agent, run or metadata. Source
- Mem0 Platform can export stored memories into structured formats defined by a schema, filtered to a subset such as one user. Source
- Anthropic's memory tool runs client-side: the application stores files under a /memories path in storage it controls, and the docs suggest validation that strips sensitive data and periodically deleting memory files not accessed in a long time. Source
- In Claude, Team and Enterprise owners control whether memory is available but cannot view or edit individual memories; deleting a conversation does not remove memory generated from it; turning memory off for an organization deletes existing entries immediately. Source
- OpenAI says ChatGPT saved memories are stored separately from chat history, deleting a chat does not delete a saved memory, and logs of deleted saved memories may be retained for up to 30 days for safety and debugging. Source
- The OpenAI Agents SDK stores conversation history in session backends such as SQLite, Redis, SQLAlchemy-supported databases or server-managed OpenAI Conversations, with clear and pop methods and an encrypted wrapper that adds TTL expiry. Source
- Letta Code tracks context including memory blocks via git, and Letta Cloud stores agents' memory, identity and conversations; Letta Code is developed by the creators of MemGPT. Source
- The FTC warned that model-as-a-service companies that break promises not to use customer data for purposes such as training their models may be liable under laws the FTC enforces. Source
- In Digi (C-77/21) the EU Court of Justice held that the storage limitation principle precludes keeping personal data in a test database longer than necessary, and that the controller must be able to demonstrate data are kept only as long as necessary; the Court also addressed purpose limitation under Article 5(1)(b). Source
- Morris et al. (Vec2Text) show text embeddings can be inverted to recover the original text: most 32-token inputs exactly and some information from longer ones, and argue embeddings should be protected like raw text. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.