Security
What is encrypted, what isn't, and who can read what. In plain words.
At a glance
| Between your device and us | Encrypted Every connection uses TLS (HTTPS). Unencrypted connections are refused. |
|---|---|
| On our servers | Encrypted at rest The database and the file storage holding your attachments are encrypted at rest by the companies that run them. |
| On your device | Not encrypted by Neu Notes Your notes are stored in your browser's storage (or the app's storage on your phone). They are protected by your device: its lock screen, your user account and its disk encryption if it's turned on. |
| Text you encrypt with a passphrase | Encrypted on your device Selected text you lock with a passphrase is encrypted before it leaves your device and is only ever decrypted there. We never see the passphrase or the text. |
| Everything else in your notes | Not end-to-end encrypted So that sync, search inside scans and export by email can work, our servers can read your notes. We don't look at them, sell them or use them for anything but running your account. |
Your account
- Passwords are never stored as written; only a one-way hash is kept.
- Two-step sign-in with an authenticator app. Backup codes are shown once and stored only as hashes.
- Changing your password signs out every other device.
Your files
- Attachments are kept per account. One person's files are never shared with or deduplicated against another's.
- Download links for attachments are signed and expire after 15 minutes.
Reading text in images
To make scans and photos searchable, their images are sent once to a text-recognition service, and the text found is saved with your note. Text that came with your imported notes is kept as it was and needs no recognition.
Deleting your account
One confirmed step in Settings. Every device is signed out and your account data is deleted at once; attachments and export files are purged from storage within 30 days. There is no grace period and no way to undo it, so export first if you want a copy.
No ads, no selling
Your notes are never shown to advertisers or sold, and they're used only to run your account.
Report a problem
If you find a security issue, write to support@samastam.xyz. We'll reply and tell you what we did about it.