Security
Local notice updated September 19, 2026. Hosted text dated May 25, 2026.
Afternote Local and the original hosted app have different security boundaries. The Local beta uses a vault on your Mac; the hosted service stores data on servers.
Afternote Local
Local vault and approved connections
Notes and the semantic index live in a SQLCipher-encrypted vault on your Mac. The private vault worker holds the key through macOS Keychain. Each supported connection requires approval and receives scoped access. Connected tools do not receive the vault encryption key. You can inspect local activity and revoke a connection from the app.
Where protection ends
A tool can retain information it has already received. Revocation cannot erase that copy, and a provider may process recalled text under its own policies. Exports are plaintext. The app does not protect against every action of malware or an attacker already controlling your logged-in Mac. Search results and saved content can be wrong or contain misleading instructions; check the original source before acting on them. See the documented security model and limitations.
Release verification and support
Official Mac releases are signed and notarized, with checksums and a signed update feed. Those checks verify origin and integrity; they are not a guarantee that software has no defects. This independently maintained beta is not represented as independently audited or certified for regulated workloads. Maintenance and security responses are best effort, with no guaranteed response or fix time. Keep your own backups.
Report privately
Email hello@afternote.dev with Security in the subject, or use GitHub's private vulnerability reporting. Avoid posting sensitive details in public issues. See the reporting policy, beta notice, and privacy notice.
Existing hosted app
The following text, dated May 25, 2026, applies to the original hosted service with Google sign-in. It does not describe the Local Mac app or a future Cloud offering.
How afternote stores, protects, and isolates your data. Honest specifics over marketing language.
Authentication
Sign-in via Google OAuth (handled by Supabase). Sessions are stored in secure HTTP-only cookies. Afternote never sees or stores your Google password.
Encryption
- At rest: AES-256 encryption on the database.
- In transit: TLS 1.2+ for all connections to and from afternote.
Data isolation
Per-user row-level security (RLS) at the database level. Every query is scoped to your user ID — no user can read or write to another user’s data, even if the application layer had a bug.
AI processing
When AI features run (chat, note classification, embeddings), relevant note content is sent to a third-party language model provider. Per that provider’s API terms, content sent through the API is not used to train their models. See /privacy for the full vendor list and what each one touches.
What it's for (and what it isn't)
afternote is for your own work notes — meeting notes, 1:1s, decisions, todos, the “where did I write that” problem. It is not built for your company’s regulated data, customer PII, pre-IPO material, or anything your security team would need to formally vet a vendor for. If that’s your use case, afternote isn’t the right fit yet — and I’d rather tell you now than have you find out later.
Admin access
There’s no feature in afternote that lets me read your notes — the app surfaces your content only to you. The honest caveat: running AI on your notes means they’re processed in plain text on the server, so I could query the database directly. Like any hosted app that runs AI on your content, I can’t cryptographically rule that out, and I won’t pretend otherwise. What I commit to: I don’t browse notes, and I’d touch an account’s data only if you ask me to for support or to debug a failure you reported — never otherwise. And I’ve built the accountability ahead of the capability: an append-only access log mirrored to write-once storage I can’t alter or delete, so the day I add any feature that can read note content, every use is recorded immutably from the start.
Backups
Supabase handles automated daily backups. Backup data is encrypted at rest. When you delete an account or notes, the live database is updated immediately; backup data ages out on Supabase’s standard retention schedule (~30 days).
Export and deletion
- Delete your account at any time. This removes your notes, embeddings, and account data from the live database immediately.
- Export your notes — currently manual. Email hello@afternote.dev and you’ll get your data back within 24 hours.
Reporting a vulnerability
Found a security issue? Email hello@afternote.dev with “Security” in the subject. You’ll hear back within 48 hours.
Honest scope
Afternote is an early-access indie product, not a SOC 2-audited enterprise platform. Security is taken seriously and built on industry-standard tools, but there are no external audits, penetration tests, or formal compliance certifications yet. If those matter for your use case, hold off and check back in 6–12 months.