Security

NoteTakr content (notes and device configs) is encrypted at rest with AES-256-GCM, using a per-user key derived via HKDF-SHA-256. This protects your data from unauthorized database access. The server holds the key to power search, export, and support — it is not end-to-end encrypted. If you need zero-knowledge protection, use a CryptKeepr end-to-end vault instead.

CryptKeepr encrypts every credential with envelope encryption by default (per-item key wrapped by a per-user, versioned master key). For your crown jewels, opt into an end-to-end vault: credentials are encrypted in your browser with a passphrase we never receive — not even a full server compromise can read them. This is genuinely zero-knowledge.

Authentication is handled by Clerk with short-lived JWTs. Every API request is validated server-side. Organization membership and roles are verified on every query and mutation — there is no trust boundary within the backend.

All data queries are scoped to the authenticated user ID. Cross-user access requires explicit sharing with a specific permission level. There is no ambient org-wide access to maps, assets, or notes.

HTTPS enforced with HSTS (2-year max-age, includeSubDomains). Content-Security-Policy blocks inline scripts and restricts connections to known origins. X-Frame-Options, X-Content-Type-Options, and Permissions-Policy headers applied globally.