NNoted
Log inGet started

Security

Security overview

Here's what's in place, what we rely on our provider for, and what we haven't built yet.

What we hold

Noted doesn't connect to banks or cards, so we never hold bank logins or card numbers. We do store your name, email, the entries you log, and any balances you type in. Our Privacy Policy has the full list.

In place today

  • Encryption in transit: all traffic uses HTTPS, and browsers are told to always use it (HSTS).
  • Passwords: stored only as salted PBKDF2-SHA256 hashes with 100,000 iterations.
  • Sessions and Siri keys: stored only as SHA-256 hashes. A Siri key is shown once and can be replaced at any time, which turns off the old one.
  • Session cookies: set as HttpOnly, Secure and SameSite=Lax, and they expire after 30 days.
  • Access controls: every data query is limited to the signed-in user's own records.
  • Abuse protection: sign-ups, logins, entries and AI questions are rate limited, and account-changing requests from other websites are rejected.
  • Your control: export your entries as CSV, and delete your account with your password.

Provided by Cloudflare

Noted is hosted on Cloudflare. According to Cloudflare's D1 documentation, stored data is encrypted at rest with AES-256. Any certifications Cloudflare holds are Cloudflare's, not ours.

Not in place yet

  • Technify Pro has no independent security certification such as SOC 2 or ISO 27001.
  • We haven't had an independent penetration test.
  • There's no two-factor login, email verification, or self-service password reset yet. These are on our roadmap.

Report a security problem

If you think you've found a vulnerability, email support@technifypro.com with "Security" in the subject. Please give us time to fix it before sharing it publicly.