Knowtarium
Start free

Security

Encrypted before it leaves your device

Your notes are encrypted on your device, with keys only you and the agents you connect can unlock. Here's how the keys work, what our servers can and can't see, where your data is stored, and the limits we haven't solved.

Start freeRead the source

The keys

Your password never leaves your device.

When you sign up, your browser makes your keys. Your password becomes a master key on your device, with Argon2id (at least 3 passes over 64 MiB of memory). From it come two values: a login hash, which is all we get when you sign in (and we store only a hash of it), and the key that unlocks your account keys.

Each workspace has its own random key, and everything in it is encrypted under that key with XChaCha20-Poly1305. You and each agent you connect get a copy of it, sealed to that holder's own key pair and signed by you, so our server can't slip in a key of its own. It's all built on libsodium, with no home-made cryptographic primitives.

On your devices

Your passwordArgon2id

Becomes your master key, on your device. Neither is ever sent to us.

Recovery key

32 random bytes, shown once when it's made, for when you forget your password. Never sent to us.

each unlocks a locked copy of

Account keysX25519Ed25519

Made in your browser when you sign up: one key pair opens your workspace keys, the other signs your changes.

opens its sealed copy of

Workspace keyXChaCha20-Poly1305

One random key per workspace. After you revoke an agent, what's written next uses a new one.

its own copy

a connected agent has its own copy of the workspace key

Agent keysX25519Ed25519

Made by the knowtarium CLI on the computer you connect: one opens its own sealed copy of the workspace key, the other signs its changes once you vouch for it.

encrypts everything in it

Note text, titles, file names, properties, tags and links, folder and workspace names, comments, history and attachments

your content leaves only encrypted

On our servers

  • Your notes, names, comments and attachments, encrypted
  • Your account keys, locked by your password and again by your recovery key
  • Each sealed copy of a workspace key, signed by you
  • Public keys and signatures
  • One-way hashes that check your password and your recovery key

None of it opens your notes without a key that's only on your devices.

How the keys fit together: your password and your recovery key each unlock your account keys; your account keys open the workspace key; each connected agent opens its own copy with its own keys; the workspace key encrypts everything in the workspace. Of your keys, our servers store only locked copies, public keys, signatures and one-way hashes; your content reaches them only as ciphertext.

What we can see

What reaches our servers.

What we can seeWhat we never see
Your account

What we can see

  • Your email address, and whether you've confirmed it
  • One-way hashes that check your password and your recovery key, never the password or the key
  • Your public keys, your password's key settings (its salt and strength), and your private keys, locked so we can't open them
  • Your sessions: when each started, was last active and ends, and the browser's user-agent, with no IP address
  • When your account was last active
  • Your app settings, such as your colour theme

What we never see

  • Your password, and the master key made from it
  • Your recovery key
  • Your private keys, unlocked
Billing

What we can see

  • Your plan, your subscription's status, and your payments (amounts, currency and dates)
  • Your customer ID at Polar

What we never see

  • Your card details: Polar takes the payment on its own pages
Your notes

What we can see

  • How much storage you use, and the size of each encrypted item
  • Version numbers, timestamps, and which generation of the workspace key each item uses
  • Counts: versions, comments, checks, pending changes and attachment chunks
  • How long each workspace keeps its history

What we never see

  • Note text, titles and file names
  • Properties, tags and links
  • Attachments, with their names and types
  • Comments and history details
  • What changed from one version to the next
Workspaces and folders

What we can see

  • IDs for your workspaces, folders, notes and attachments, and how they nest
  • Each change to a folder (who made it, when, and where it moved, by ID), with its name before and after, encrypted
  • Which folder is the workspace's root, by ID

What we never see

  • The names of your workspaces and folders
Agents

What we can see

  • Which person or connected agent made each change, and what kind it was (an edit, a deletion, an approval), by ID, with the signature on signed changes
  • Which notes, by ID, each agent or browser fetches, and when, as the request arrives (the sync API doesn't record it)
  • Whether each of your agents' checks was applied or dismissed
  • Each agent's access (read or read-write, and which folders, by ID), its permissions and every change to them you signed, its public keys, and when it was connected, last used or revoked
  • Which folders ask you first, by ID, and when you changed that
  • Which notes are your instructions for agents, by ID, in a list you signed, and when you or an accepted change updates them

What we never see

  • Your agents' names
  • The content of what an agent read, wrote or proposed
  • What your instructions for agents say
  • What your agents' checks found and which notes they compared
The web clipper

What we can see

  • Which folder is each workspace's inbox, by ID, and the inbox's public key, with your signature
  • For each extension you connect: a hash of its access token, its signing public key with your signature, the workspace it saves to (by ID), and when it was connected, last used, last saved a page and disconnected
  • For each page waiting in the queue: its encrypted size, when it arrived and which extension sent it. It's deleted from the queue once it's filed as a note

What we never see

  • The link, title, note and category of each page you save
  • The extension's name
Network and search

What we can see

  • Your IP address, which reaches our servers with every request: the sync API doesn't record it (its rate limits keep only a keyed hash), and Vercel, which serves the web app, keeps it briefly in its server logs

What we never see

  • Your searches and your graph: both are built on your device

Two providers see a little more. Polar's notifications to us also carry your name and billing address, which we don't store, and we can see them in Polar's dashboard. Resend, which sends our account emails, gets your address and each email's content.

The web clipper browser extension holds no key that reads your notes: each page it saves is encrypted in your browser. The privacy policy says what it reads and what we store.

The privacy policy lists the same data, with why we keep it and for how long.

Where it lives

Stored in the EU.

Our sync API's databases, storage buckets and workspace objects are kept by Cloudflare in its EU jurisdiction: the databases and buckets were created there, and every workspace lives in a Durable Object created there too. Our deploy check refuses a setup that would put the workspaces or the buckets anywhere else. Short logs of failures and of unusual billing notifications from Polar (what happened and where in our code, with technical IDs such as Cloudflare's request ID or Polar's notification ID; never IP addresses or your content) are kept by Cloudflare's logging, which that setting doesn't cover.

That's about where the data is stored. Cloudflare, a US company, runs the sync API for us as our processor. This website and the web app are served by Vercel, account emails are sent by Resend, and Polar sells the paid plans as merchant of record. Your notes reach them only encrypted, if at all; the privacy policy says what each one gets.

  • EU jurisdiction

    D1 databases

    Your account, your keys in locked form, your connected agents and browser extensions, and your billing status.

  • EU jurisdiction

    R2 buckets

    The encrypted versions of your notes, your agents' proposed changes and your attachments.

  • EU jurisdiction

    Durable Objects

    One per workspace: its folders, versions, comments and history records, and pages waiting from the web clipper, by ID and encrypted.

Agents

Your agent decrypts on your computer.

  • 01

    Decrypted on your computer

    Connecting, with or by asking your agent, makes the agent's own keys on your computer and gets a copy of the workspace key sealed to them. The MCP server your agent runs decrypts notes there. Your notes pass through our servers only as ciphertext.

  • 02

    Vouched for by you

    When you approve an agent, you sign its key. Each change it saves is signed with that key, shown as the agent's, and can be undone in one click. In folders set to Ask me first, its changes wait for you instead. It deletes or reorganizes only with permissions you give it, each signed by you.

  • 03

    Its AI provider sees what it reads

    Whatever your agent reads goes to its AI provider (for example Anthropic or OpenAI), under that provider's terms. We run no AI models, so nothing goes to one on our behalf.

  • 04

    Revoke it at any time

    Revoking an agent shuts it out of our servers at once, and what's written from then on uses a new workspace key the agent doesn't have. It keeps what it already read, and the old key.

Remote connectors aren't here yet. Connectors for claude.ai and ChatGPT are planned to run in an attested enclave: a sealed server whose code your browser checks before it hands over a key. None exist today, so no Knowtarium server decrypts your notes.

Known limits

What encryption can't fix.

We serve the web app's code

Each time you open the web app, your browser loads the code that encrypts your notes from us (it's hosted on Vercel). If that code were tampered with, at our end or our host's, it could leak your keys, and you couldn't easily tell. A strict Content Security Policy lets the app run only its own scripts and talk only to itself and our sync API (and, while you connect an agent, to the CLI on your computer), which keeps injected scripts out, but it can't protect you from a bad deploy. There's no way yet to check the code your browser runs.

Lose both, and it's gone

If you lose both your password and your recovery key, we can't decrypt your notes and neither can you (only agents you'd already connected still can, until you start over). You can start over with the same email, but that deletes every workspace in the account.

Metadata we can't hide

Your email, sizes, timestamps, counts, how your folders and notes nest, which notes are fetched and when, and which agent changed what. Someone with access to our servers could learn when and how much you work, never what you wrote.

A revoked agent keeps the old key

A new key protects only what's written after a revocation: nothing is encrypted again. What was written before stays under the old key: a note until it changes and its old version's history period has passed, and comments, history records and attachments for as long as they're kept. A revoked agent could still read it if it got hold of those encrypted copies, which our servers no longer give it.

Folders and permissions are enforced by our server

An agent you limit to some folders, or don't allow to delete, still holds the workspace key; it's our server that keeps the other folders from it and refuses what you didn't allow. Agents never delete attached files, and each delete, move or folder change is signed by the agent, checked by the app against the permissions you signed, and listed with Undo for two weeks, or your history period if that's shorter (a deleted note comes back while your history period keeps it). Their conventions tell them to delete or reorganize only when you ask, but that's an instruction, not a lock. If a folder must stay out of an agent's reach whatever happens, keep it in another workspace.

Instructions guide, they don't enforce

Your folder instructions tell an agent how to write, but the model can still get them wrong, and a modified client could skip them. What we do enforce is who changes them: our server refuses an agent's direct write to them, and an agent applies only instructions you signed. An agent limited to some folders also reads the instructions above its folders, so keep there nothing it shouldn't see.

Open source

Read the code.

The encryption, the key handling, the sync client, the CLI and the MCP server are open source under the MIT license, in knowtarium-sdk. The web app is built on the same package. Each release of the CLI since 0.1.0 is published to npm from that repository with provenance, so npm records which build made it.

No independent security audit has been done yet. If you find a problem, please report it privately by email to support@knowtarium.com with “Security” in the subject.

knowtarium-sdk on GitHubPrivacy policy