Security

modulate.pro is built and run by one small company. There is no security theatre here and no certification to wave at you. What there is, is a system with a small number of deliberate rules, each of which is written down below along with what it does not cover.

The rule everything else follows from: your notes are yours, and nothing is shared unless you shared it. There is no default-public anything, no team-wide visibility that turns on when somebody joins, and no view an administrator can use to read your writing.

• ·Passwords are never stored. What we keep is a scrypt hash with a random 16-byte salt generated per password, compared in constant time so the comparison itself can't be used to guess. A copy of the database does not hand anybody a working password.
• ·You don't need a password at all. Signing in by emailed link or a one-time code works throughout, so an account can exist with no password to leak or reuse.
• ·Invite and reset links are single-use and expiring. Only a SHA-256 hash of the link's token is stored, so the same is true of it as of passwords: the database doesn't contain anything you could click. A reset link lasts an hour, an invite three days, and sending a new one invalidates the old one rather than leaving two live doors.
• ·Sessions are signed cookies that JavaScript on the page cannot read, so a cross-site scripting bug can't simply lift your session and post it somewhere.

Every read of your material is scoped to your account at the point the query is written, not filtered afterwards in the page. There is no “fetch everything, then hide what isn't yours” step, which is the shape almost every accidental data leak in a product like this takes.

• ·Sharing is an explicit act, one note at a time, to a person you are already connected with. There is no folder that becomes visible to a group, and no link that makes a note public to anyone holding the URL.
• ·Meeting prep stays private even on a meeting everyone else is in. What you plan to raise and what was actually said are separate fields with separate visibility, and deliberately so: a shared meeting record that quietly exposed your own strategy notes would be worse than no shared record.
• ·Every plan limit is enforced on the server, not just hidden in the interface. The interface dims things; the server refuses them.
• ·Per-account request ceilings mean one account, or one stolen session, cannot hammer the service on everybody else's behalf.

The site is served only over HTTPS, and it tells your browser to remember that for two years, so after the first visit your browser upgrades the request itself rather than making an unencrypted one and trusting a redirect.

• ·The app refuses to be framed by any other site, which is what stops a clickjacking overlay turning a stray click into “delete my account”.
• ·Browsers are told not to guess at file types, so an uploaded file can never be executed as script because a browser second-guessed its content type.
• ·Full addresses are never sent to other sites. Note and meeting identifiers appear in the address bar, so a link you follow out of the app receives only that you came from here.
• ·The app asks for notifications and nothing else. Camera, microphone, location and the rest are switched off at the page level, so a compromised dependency cannot quietly reach for one. The single exception is the payment API on the checkout page, which is how Apple Pay and Google Pay work at all.
• ·One button hides everything on screen. Every note and tag blurs at once, without closing what you were doing or losing your place, and Escape brings it back. It is for the ten seconds somebody is standing behind you and nothing more: the text is still in the page for anyone who opens developer tools, and it is not a substitute for locking your screen. It is also deliberately forgotten on reload, because a board you have to work out how to un-hide is worse than one that was never hidden.
• ·Importing happens on your device. When you bring notes in from another app, the files are read and parsed in your browser. Nothing is uploaded while you are deciding, and only the notes you confirm are ever sent. A decade of private writing shouldn't have to cross the network to find out whether the format is readable.

Every company below is one the running system genuinely talks to. There is no advertising network, no third-party analytics, no tracking pixel and no third-party cookie. The page-view counting described in the privacy policy is our own and never leaves our servers.

• ·Railway. Hosting, and the managed Postgres database the application reads from. It is backed up every day, fully every week, with every write in between archived continuously, so a bad migration can be rewound to the minute rather than to whichever midnight the last backup fell on.
• ·An S3-compatible object store. Images you attach to notes. Attachments live outside the database and are size- and type-checked before they are accepted.
• ·Resend. Sign-in codes and links, invitations, password resets and receipts for a plan. It sees your email address and the contents of those messages, none of which ever contain your notes.
• ·Stripe. Payments. Card details go to Stripe and never reach us; we hold a customer reference and a subscription status.
• ·Anthropic, and only if you turn suggestions on. Off by default, per account, in Account settings. Nothing is sent while it is off, and nothing is ever sent on a schedule. With it on, a suggestion sends the text of the one note it is about. Modo is the exception, and it is named here rather than left for you to work out: a question you ask it about your board sends the recent part of that board, roughly the last two weeks of notes, meetings and open actions, because that is what the question is asking about. None of it is kept or trained on. Every suggestion is something you confirm; nothing is written to a note because a model said so. Turning it back off stops any further sending immediately.
• ·Your browser vendor's push service, only if you turn notifications on. Google, Apple or Mozilla, depending on the browser. Notification payloads are encrypted for your specific browser before they are handed over, so the push service delivers them without being able to read what they say.

• ·Export is free on every plan, including the free one, and returns everything (notes, tags, checklists, deadlines, chats, connections and meetings) as a single JSON file. It is not a paid feature and never will be.
• ·Deleting your account genuinely deletes it. Notes, tags, checklists, images, connections, shares, sessions and push subscriptions are removed, and uploaded files are deleted from the object store rather than merely unlinked. Two things survive by design: messages you sent in a shared conversation stay with your name removed, so other people's threads still read properly, and billing records are held by the payment provider because tax law requires it.

A page like this is easy to write without this section. Here it is, because you will find these out anyway and it is better that you find them here.

• ·Your notes are not end-to-end encrypted. The server can read them, and some of what the product does needs that: a link you paste is fetched and previewed, an unfinished action is copied to the next meeting, a shared card is handed to somebody else, and a chat notification carries a preview. Searching is not on that list, as it happens, because search runs in your browser over notes already loaded, and never as a query the server sees. If you need writing nobody but you can ever decrypt, this is not the right tool for that writing, and we would rather say so than bury it.
• ·There is no SOC 2 report, no ISO 27001, and no third-party penetration test. Those are real work and real money, and claiming any of them would be a lie that is trivial to check. If your procurement process requires one, we are not ready for you yet.
• ·We are one company, not a security department. There is no bug bounty programme and no 24-hour on-call rota. There is an address that a person reads.

Whether the system is working right now is answered live on the status page, which checks the database and the reminder scheduler when you load it rather than reporting a switch somebody remembers to flip. It is public, because the person asking "is it down or is it me" is often the person who cannot get in.

What we commit to, plainly, because these are promises rather than claims about the past:

• ·If your notes are affected, you hear from us by email. Not a status page you would have to think to check. That means anything that lost, exposed or corrupted your writing, and it means telling you what we know while we still only half know it, rather than going quiet until the story is tidy.
• ·An outage that only made the app slow or unreachable gets said afterwards, on the status page and in a reply to anyone who wrote in. Your notes are on your devices while the server is away, so this is the less serious kind, and it still gets said rather than left to be noticed.
• ·The backups above are Railway's and are ours to restore from. A backup every day, a full one every week, and a continuous archive of every write in between, which is what makes a bad migration recoverable to the minute instead of to whichever midnight came last.
• ·The honest limit on all of this is that we are one company. There is no rota and no second pair of hands, so "quickly" means as quickly as one person who has been woken up can manage. Anybody promising you a number here without the staff to hold it is telling you what you want to hear.

If you find something, write to noah@modulate.pro and say what you found and how to reproduce it. You will get a reply from a person. We will not threaten you, and we will fix it and say when it is fixed.