Security

modulate.pro is built and run by one small company. There is no security theatre here and no certification to wave at you. What there is, is a system with a small number of deliberate rules, each of which is written down below along with what it does not cover.

The rule everything else follows from: your notes are yours, and nothing is shared unless you shared it. There is no default-public anything, no team-wide visibility that turns on when somebody joins, and no view an administrator can use to read your writing.

• ·Passwords are never stored. What we keep is a scrypt hash with a random 16-byte salt generated per password, compared in constant time so the comparison itself can't be used to guess. A copy of the database does not hand anybody a working password.
• ·You don't need a password at all. Signing in by emailed link or a one-time code works throughout, so an account can exist with no password to leak or reuse.
• ·Invite and reset links are single-use and expiring. Only a SHA-256 hash of the link's token is stored, so the same is true of it as of passwords: the database doesn't contain anything you could click. A reset link lasts an hour, an invite three days, and sending a new one invalidates the old one rather than leaving two live doors.
• ·Sessions are signed cookies that JavaScript on the page cannot read, so a cross-site scripting bug can't simply lift your session and post it somewhere.

Every read of your material is scoped to your account at the point the query is written, not filtered afterwards in the page. There is no “fetch everything, then hide what isn't yours” step, which is the shape almost every accidental data leak in a product like this takes.

• ·Sharing is an explicit act, one note at a time, to a person you are already connected with. There is no folder that becomes visible to a group, and no link that makes a note public to anyone holding the URL.
• ·Meeting prep stays private even on a meeting everyone else is in. What you plan to raise and what was actually said are separate fields with separate visibility, and deliberately so: a shared meeting record that quietly exposed your own strategy notes would be worse than no shared record.
• ·Every plan limit is enforced on the server, not just hidden in the interface. The interface dims things; the server refuses them.
• ·Per-account request ceilings mean one account, or one stolen session, cannot hammer the service on everybody else's behalf.

The site is served only over HTTPS, and it tells your browser to remember that for two years, so after the first visit your browser upgrades the request itself rather than making an unencrypted one and trusting a redirect.

• ·The app refuses to be framed by any other site, which is what stops a clickjacking overlay turning a stray click into “delete my account”.
• ·Browsers are told not to guess at file types, so an uploaded file can never be executed as script because a browser second-guessed its content type.
• ·Full addresses are never sent to other sites. Note and meeting identifiers appear in the address bar, so a link you follow out of the app receives only that you came from here.
• ·The app asks for notifications and nothing else. Camera, microphone, location and the rest are switched off at the page level, so a compromised dependency cannot quietly reach for one. The single exception is the payment API on the checkout page, which is how Apple Pay and Google Pay work at all.
• ·Importing happens on your device. When you bring notes in from another app, the files are read and parsed in your browser. Nothing is uploaded while you are deciding, and only the notes you confirm are ever sent. A decade of private writing shouldn't have to cross the network to find out whether the format is readable.

Every company below is one the running system genuinely talks to. There is no advertising network, no third-party analytics, no tracking pixel and no third-party cookie. The page-view counting described in the privacy policy is our own and never leaves our servers.

• ·Railway. Hosting, and the managed Postgres database the application reads from.
• ·An S3-compatible object store. Images you attach to notes. Attachments live outside the database and are size- and type-checked before they are accepted.
• ·Resend. Sign-in codes and links, invitations, password resets and receipts for a plan. It sees your email address and the contents of those messages, none of which ever contain your notes.
• ·Twilio. Only if you verify a phone number for texting notes in. Inbound messages are checked against Twilio's own signature before being trusted.
• ·Paddle. Payments. Card details go to Paddle and never reach us; we hold a customer reference and a subscription status.
• ·Your browser vendor's push service, only if you turn notifications on. Google, Apple or Mozilla, depending on the browser. Notification payloads are encrypted for your specific browser before they are handed over, so the push service delivers them without being able to read what they say.

• ·Export is free on every plan, including the free one, and returns everything (notes, tags, checklists, deadlines, chats, connections and meetings) as a single JSON file. It is not a paid feature and never will be.
• ·Deleting your account genuinely deletes it. Notes, tags, checklists, images, connections, shares, sessions and push subscriptions are removed, and uploaded files are deleted from the object store rather than merely unlinked. Two things survive by design: messages you sent in a shared conversation stay with your name removed, so other people's threads still read properly, and billing records are held by the payment provider because tax law requires it.

A page like this is easy to write without this section. Here it is, because you will find these out anyway and it is better that you find them here.

• ·Your notes are not end-to-end encrypted. The server can read them, and has to: search, reminders, carrying an unfinished action to the next meeting and texting a note in are all things a server that cannot read your writing cannot do. If you need writing nobody but you can ever decrypt, this is not the right tool for that writing, and we would rather say so than bury it.
• ·There is no SOC 2 report, no ISO 27001, and no third-party penetration test. Those are real work and real money, and claiming any of them would be a lie that is trivial to check. If your procurement process requires one, we are not ready for you yet.
• ·Automated database backups are still being set up. Until they are, the export on your account page is the copy you control, and it is free on every plan for exactly this reason. Taking one occasionally is a reasonable thing to do, and we would rather tell you that than let you assume otherwise.
• ·We are one company, not a security department. There is no bug bounty programme and no 24-hour on-call rota. There is an address that a person reads.

If you find something, write to noah@nupikwenpach.com and say what you found and how to reproduce it. You will get a reply from a person. We will not threaten you, and we will fix it and say when it is fixed.