Security
Your secrets are encrypted at rest the moment they reach our servers, and only decrypted when your vault executes. Guardian's Recovery Vault goes further: it encrypts entirely in your browser before anything ever leaves your device. Here's exactly how we do it.
The short version, in plain English
Every note is encrypted with Fernet symmetric encryption, and every file is encrypted with streaming AES-256-GCM, before it's written to storage. The encryption key is stored separately from your content, so even if someone copied the database, they'd have meaningless bytes.
Your notes and files are encrypted before storage. Our servers, logs, and staff never have access to the plaintext of what you've written. Titles are stored unencrypted (to help you stay organised), but content is always encrypted.
For extra-sensitive items, you can opt for our Two-Person Secret mode. When your vault executes, the secret is mathematically split into a separate share for each of your selected recipients (2 or more), using a well-established secret-sharing technique. Any 2 of those shares are enough to reconstruct the original message, but a single share, on its own, reveals absolutely nothing about it.
Text notes
The note text itself is split among your recipients. Any 2 of them paste their shares into notenz.com/reconstruct/, and the original message is rebuilt entirely in their browser. Nothing is sent back to Notenz.
Files
For files, Notenz splits the access to the file, not the file itself. A short random access token is split among your recipients using the same scheme. When any 2 of them combine their shares at the reconstruct page, the browser uses the reassembled token to request the file. Notenz decrypts it server-side and streams it as a direct download. No single share alone can produce the token.
Delivery links, split-secret share links, recipient confirmation links, and recall links are all protected against automated guessing and abuse. If a single link receives an unusually high number of requests from the same source, further requests are temporarily blocked and the vault owner is notified by email so they can review their account's audit log.
Recovery Vault items are encrypted entirely in your browser before upload. Notenz's servers store only ciphertext: never your plaintext secrets, never your encryption key. Even a full Notenz database breach exposes nothing readable.
Technical specification
Important limitation
Recovery Vault requires your Notenz password to decrypt. If you forget your Notenz password, your vault secrets cannot be recovered. That's by design: there is no server-side backdoor.
All traffic between your browser and our servers is encrypted in transit using TLS (HTTPS). We use CSRF protection on all state-changing endpoints. Session cookies are marked as HttpOnly and Secure.
Passwords are hashed using Django's PBKDF2 with SHA-256, the industry standard. We also support login via a one-time code sent to your email (no password required).
We take security reports seriously. If you've found a vulnerability, please email us at [email protected]. We'll respond within 48 hours and work with you to address the issue. We don't have a formal bug bounty programme yet, but we deeply appreciate responsible disclosure.