Env is for bootstrap, not for runtime
Environment variables are the right place for exactly one thing: the handful of values a process needs to start and find its database. Everything else — integration credentials, model providers, retention windows, per-customer settings — is runtime configuration, and putting it in the environment scatters it across deploys, hides it from the running system, and makes it impossible to change per customer without a redeploy.
So we draw a hard line. The environment bootstraps the process; the database holds the configuration the running system reads. A missing bootstrap value fails loudly at startup rather than silently degrading, because a service that quietly runs with half its configuration is a service waiting to behave differently in one environment than another.
Per-tenant, encrypted, read through one module
Configuration lives per tenant — per household, in a consumer product like Memoria — in an encrypted store, and every part of the code reads it through a single config module rather than reaching for raw values directly. One module means one place to change how configuration is resolved, cached, and decrypted, and one place a reviewer has to trust.
Because each customer's integrations, model providers, retention, and data flows are their own rows in their own encrypted space, the isolation is structural. A customer controls their own configuration because of where it lives, not because a policy says they may. If a proposed feature cannot be expressed as per-tenant configuration, that is a design signal to resolve before code, not after.
Why this is the privacy thesis, not a feature of it
Ekarche's bet is that profitable software does not need to exploit user data. The reason that can be a guarantee rather than a hope is that the configuration governing every data flow lives in a per-tenant encrypted database the customer controls — it is enforced by structure, not asserted on a settings page. Take the database away and the promise becomes marketing again.
This pattern is shared across our products and it is the same one we bring to custom work. The details — schema, crypto, caching, cross-language compatibility — are engineering; the decision to put configuration there is the ethics. Read the wider thinking in the case against selling your data.