Legal
Security
Last updated 2026-10-29
This page describes the security measures in Notemark as it runs today. If you need answers for a security review, email support@notemark.app.
Hosting
Notemark runs on Vercel and stores data in Supabase (PostgreSQL) in the AWS us-east-1 region. Every connection to Notemark uses HTTPS.
Access control
Each workspace member has a role (owner, admin, editor or viewer). Every API route checks the caller's role, and row level security policies in the database check again which workspace a request may read or write.
Sign-in
You can sign in with a password, with Google, or with a passkey. Passwords are handled by Supabase Auth and never stored by us in readable form. Sign-in attempts are rate limited.
Integrations and payments
Access tokens for the tools you connect are encrypted with AES-256-GCM before they are stored. Card details go straight to Stripe and never reach our servers.
The canvas proxy
The proxy that loads your pages refuses private, local and cloud metadata addresses, so it cannot be used to reach internal networks.
Monitoring
Errors are reported to Sentry so we can fix them quickly, and actions staff take in support tools are recorded in an audit log.
Reporting a vulnerability
If you find a security issue, email support@notemark.app with the details and steps to reproduce it. Please give us a chance to fix it before you share it, and do not access or change other people's data while testing. We will reply and keep you updated until it is resolved.