Trust & security

Security and privacy by design.

Noet connects to the tools you already use. That means we take access seriously: least privilege, encryption in transit, careful logging defaults, and subprocessors we can name. This page explains local storage, cloud processing and the evidence needed before we publish an encryption or compliance assurance.

Encryption and compliance status

AES-256 local encryption

Verified in the tested Apple Silicon Mac build: the app and capture databases use AES-256 encrypted SQLite, and managed files—including snapshots and retained audio—use authenticated AES-256-GCM.

This scope excludes user originals, deliberate exports, historical OS backups and unverified cloud copies. It does not establish end-to-end encryption or a blanket compliance assurance. Availability in the downloadable release must be confirmed separately.

OS-protected keys

The tested Mac build wraps its installation key using Electron safeStorage and the macOS Keychain. Separate keys protect the main database, capture database and managed files. Unavailable or invalid keys block access rather than silently resetting encrypted data.

Recovery requires matching data, original keys and OS key-store access. Synthetic fixture restoration passed; full original login-Keychain and Time Machine recovery remains unverified. There is no independent recovery-key escrow.

Encryption coverage

Noet has not verified AES-256 encryption across all sensitive local and cloud data. Local database and managed-file encryption, migration and synthetic fixture restoration have passed in the tested Mac build. The tested scope does not establish protection of all stored copies or all recovery methods. Device disk encryption depends on your Mac settings. Server-side integration tokens use AES-256-GCM, which does not establish encryption of every stored copy.

Local and cloud copies, attachments, temporary files, migrations and backups need separate coverage checks. Transport encryption is distinct from encryption at rest. Encryption at rest does not prevent authorised processing or establish end-to-end encryption.

SOC 2 audit status

Noet does not currently claim a SOC 2 Type II audit. No qualifying issued report has been substantiated for this service.

A Type II assurance requires an issued report from an independent licensed CPA firm covering the service and an operating period. Readiness work, a Type I report and a provider’s audit do not establish a Noet Type II audit. Contact us to discuss scope, audit period and access to available evidence; restricted reports are shared only through a controlled process.

Healthcare and HIPAA scope

Noet does not currently offer a substantiated HIPAA-compliant healthcare configuration. Do not use Noet for protected health information under an assumption of HIPAA compliance.

Healthcare eligibility requires a reviewed operating scope, safeguards, risk remediation, approved providers and required Business Associate Agreements (BAAs). A BAA is required before an eligible customer configuration handles PHI. There is no official HHS HIPAA certification; a private certificate alone does not establish compliance.

Practices

How we protect user data

Expand a topic for plain-language detail. Nothing here is a legal agreement; see our Privacy Policy and Terms for binding language when published.

Local database and managed-file encryption, migration and recovery remain under verification. Disk encryption depends on your device settings. Server-side integration tokens use AES-256-GCM. We have not substantiated a blanket AES-256 claim covering local content, cloud copies and backups.

Ask Noet conversations and other supported records can sync to the backend. Selected context can reach hosted AI providers, and audio transcription may use cloud services. Network requests use HTTPS; this is separate from encryption of stored data.

Subprocessors

Vendors that may process data on our behalf

We rely on specialized providers for payments, backend, hosting, observability, analytics, and model inference. Each link goes to their privacy or trust documentation. The list updates as our architecture evolves.