Security

The server stores ciphertext. The encryption key is derived on your device from your encryption password and never leaves the device. We have no recovery path for the data of a user who forgets that password. Hosting is in Switzerland.

End-to-end encryption by default. Note content is encrypted client-side with AES-256-GCM. The encryption key is derived from your encryption password with PBKDF2-HMAC-SHA256 at 600,000 iterations and a per-user random salt. The derived key is a non-extractable browser CryptoKey - it cannot be exported and is never sent to the server.

Strong authentication. Login uses a hashed password with bcrypt at cost 12. Two-factor authentication is supported via TOTP, with replay protection across the drift window. WebAuthn passkeys are supported. Sessions have an absolute 90-day lifetime cap; the rolling refresh cannot extend past it.

Hardened token storage. Every long-lived link token (password-reset, email-verification, email-change, pending-2FA, session token) is stored as a one-way SHA-256 fingerprint at rest. A database leak does not yield replayable tokens.

Authenticated cryptography for 2FA secrets. TOTP secrets are encrypted with AES-256-GCM and bound to the user ID via additional-authenticated-data. The mode detects tampering; an attacker who can write to the database cannot transplant another user's TOTP secret onto their own row.

Breached-password screening. When you set a password, we check it against the public corpus of known-breached passwords using a k-anonymity protocol (only a 5-character hash prefix leaves our server; the password and its full hash do not).

Re-authentication for sensitive operations. Account deletion, change of encryption password, and similar high-impact actions require a fresh password verification, even when the session is active. A stolen session token alone is not enough.

Strict browser security headers. The Content-Security-Policy on the SPA allows only inline scripts pinned by exact cryptographic hash; 'unsafe-inline' is not used for scripts. HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy are set on every response.

Local data wiped on logout. When you sign out, the encrypted note mirror (used for fast on-device search), the IndexedDB cache, and the OPFS-backed SQLite pool are all removed from disk - not just closed. This matters on shared or kiosk devices.

Documented key rotation. Procedures for rotating every long-lived secret used by Takt (TOTP encryption key, VAPID web-push keys, APNs auth key, admin and database credentials) are documented internally with trigger conditions, rollout steps, and rollback paths.