Browse documentation

Privacy and security

"Local-first" describes where Noet keeps its searchable index; it does not mean every feature is offline. The useful boundary is what stays on your Mac, what reaches a provider, and what you control.

What stays local

Noet stores its indexed local data in ordinary SQLite on your Mac. Application database encryption is not currently established; device disk encryption depends on your Mac settings. Moments capture and its searchable text are part of the local index.

What leaves the device

External data flows are feature-specific:

  • Connected services receive their normal sync and OAuth requests.
  • Ask Noet conversations and other supported records can sync to Noet’s backend.
  • When Ask Noet generates a response, selected relevant context may be sent to the configured AI provider.
  • Audio transcription may use cloud providers.
  • Optional product services such as authentication, billing, analytics, and error reporting have separate, documented data paths.

Local storage reduces the need for a separate cloud search database containing your entire work history, but it is not a promise that no data ever leaves the device.

Control and verification

  • Keep any integration disconnected if you do not want it searched.
  • Pause or exclude applications from Moments capture.
  • Review requested provider scopes before connecting.
  • Confirm externally visible and destructive actions before they run.
  • Follow source links when an answer affects an important decision.

Encryption and compliance status

Server-side integration tokens use AES-256-GCM. This does not establish encryption of every local or cloud copy. Noet has not substantiated broad AES-256 coverage, a SOC 2 Type II audit or a HIPAA-compliant healthcare configuration. A future healthcare offering requires a reviewed scope and required BAAs before handling protected health information.

Uninstalling the app does not necessarily remove its stored application data or cloud copies. Use the available deletion controls and contact support for account/cloud deletion and applicable backup retention; immediate erasure from every backup is not promised.

Source of truth

For current subprocessors, security controls, and policy details, use Noet's public Security and Privacy pages. These product docs explain behaviour; they do not replace your organisation's legal or compliance review.