GoodMem

GoodMem is not a fact-extraction or auto-summarizing memory layer — by the vendor's own FAQ, "a memory is a document, not an extracted fact." You submit content, GoodMem stores the original, extracts text, chunks it per a space's configuration, embeds each chunk (optionally through several embedders combined with per-embedder weights for hybrid dense+sparse search), and returns cited chunks at query time. It explicitly does not resolve contradictions between an old and new fact, does not expire memories on a timer, and has no in-place update — correcting a memory means delete-then-recreate. That's a narrower, more mechanical scope than some competing "agent memory" products claim, and it's stated plainly rather than buried.

The GoodMem server ships only as a binary/container under the GoodMem Free Binary License v1.0. It's free for internal use and for commercial SaaS products built on it, and you may embed it in your own containers or installers — but you may not offer GoodMem itself as a standalone hosted/managed/white-labeled service, and you get no rights to the source code (source_url: https://goodmem.ai/license). PAIR Systems confirms directly: "GoodMem is not open source... 'Free' in the license name refers to price for the covered uses, not to software freedom" (https://goodmem.ai/resources/faq). The five client SDKs (Python, TypeScript, Java, Go, .NET) and the MCP server are separately published under Apache-2.0 and are genuinely open. There is no public repository for the server itself — the PAIR-Systems-Inc GitHub org has ~80 repos, nearly all SDKs, framework integrations (LangChain, LlamaIndex, CrewAI, n8n, etc.) or docs, but a request for github.com/PAIR-Systems-Inc/goodmem returns 404.

GoodMem publishes a release-pinned security comparison against five competitors (Mem0, Supermemory, Cognee, OpenViking, Graphiti), scoring each on signed image verification, provenance, hardened runtime, TLS, authorization model, and FIPS posture, with dated evidence links to specific commits and workflows (https://goodmem.ai/enterprise-security, refreshed 2026-08-19 and 2026-09-04). Verified independently: the server image (server-v1.0.307) does carry SLSA Build L3 provenance the CLI checks by default, and runs as non-root UID 65532 on a distroless Java 21 image. PAIR Systems holds ISO/IEC 27001 certification today; a SOC 2 Type II audit is in progress with no report yet (confirmed on both the FAQ and the SafeBase-hosted trust center, https://trust.pairsys.ai/). The trust center currently lists two named reference customers, Incorta and Wanclouds. This level of self-published, dated, evidence-linked security comparison is not typical of a company this size — most competitors in that same table score 'not located' on several rows GoodMem scores 'directly evidenced' on.

GoodMem's headline claim — a 28% cut in aggregate LLM token burn and 23% fewer agent reasoning steps with no measurable quality change — comes from a PAIR Systems-authored whitepaper (https://goodmem.ai/resources/cutting-agent-token-burn), not an independent study. The methodology is disclosed in some depth: 17 matched scenarios on one production enterprise BI agent, 3 replicates per condition, bootstrap confidence intervals (95% CI 2–47% on the token figure), and the paper itself flags it as a "pilot-scale benchmark" with "broader multi-tenant validation in progress." Treat the 28%/23% figures as GoodMem's own reported result on one customer's workload, not a generalizable number — the wide confidence interval (2% to 47%) says as much on its own.

Self-hosting is free for commercial use (infrastructure and any inference-provider costs are on you). GoodMem Cloud starts at $15/month and bills by the second for compute plus storage, with a 14-day free trial and no credit card required; a full rate card was not published at review time ("Pricing estimator coming soon") (https://goodmem.ai/pricing). Enterprise tier is custom-quoted and adds OEM/white-label rights, an MSP/reseller license, source-code access for audit, and a 99.99% uptime SLA. Self-hosting needs only a container runtime and a PostgreSQL database with pgvector — no separate vector store, broker, or object store — and one-command installers exist for Railway, Fly.io, AWS Lightsail, Hetzner, and Google Cloud Marketplace. There is no Kubernetes operator or Helm chart; teams on Kubernetes write their own manifests.

No SSO, SAML, OIDC, or SCIM — authentication is API keys plus a one-time enrollment credential; offboarding means deleting the user account entirely. No packaged connectors for SharePoint, S3, or Confluence — GoodMem exposes ingestion APIs and expects you (or a paid engagement) to write the pipeline. No structured JSON logging or OpenTelemetry tracing yet, just Prometheus metrics and request-ID correlation. GoodMem Cloud has no EU region and isn't offered under a HIPAA BAA; regulated-data customers are pointed toward self-hosting instead. All of this is disclosed plainly in the vendor's own FAQ rather than discovered by digging (https://goodmem.ai/resources/faq).