General

We like our notes informative, tidy, and secure. Our end-to-end encryption feature encrypts all your notes and tasks on device level, before leaving your device. This ensures your notes are for your eyes only. And for the eyes of those whom you share your notes and tasks with.

Most note-taking applications encrypt the content in-transit, while the actual notes are stored in plaintext format in a database. Some note-taking applications store the content in encrypted format, but store the key in the same database making unauthorized access possible and leaving security gaps.

We wanted to step up our security game by providing true end-to-end encryption. In practice, this means potential eavesdroppers, such as telecom providers, internet providers, hosting providers, or even our personnel, cannot decrypt your content.

How does it work?

When you enable end-to-end encryption, a private key is stored on your local device. A second key, a public key, is stored on our servers. We use the public key to encrypt your content and only your private key can decrypt the content. This is called asymmetric encryption.

You need to fill in a password when enabling end-to-end encryption. This password is not stored on our severs. When you open Organizedly on a new device, such as a laptop or mobile phone, you will need to enter this password after login. Once entered, a private key is stored on the new device and content can be decrypted on the new device.

If you lose your password, you can still access your notes from the devices that have the private key. If you lose your password and devices with the private key, we cannot decrypt your content.

The password is used for decrypting the private key, which is stored on our servers. Only you can decrypt the private key, as we do not store your password. We use elliptic curve BLS12-381 to derive a 128-bit strong key from your password. This key is used to encrypt your private key.

What is encrypted

We encrypt the following sensitive data in your notes and tasks:

  • Note title
  • Note content (we call them blocks)
  • Title of tasks and subtasks
  • Description of tasks and subtasks
  • Pictures inside notes

What is not encrypted

For making Organizedly function, we use meta-data for notes and tasks. The meta-data includes:

  • Timestamps for when a note/task is created, updated, or visited
  • Unique identifiers, which are long randomly generated strings
  • Unique identifiers of linked notes
  • Priorities of tasks
  • Tags in tasks and notes stored as a separate array
  • Statuses, such as archived, completed, or open
  • Titles of collections

I want to make my notes safe. What should I do?

Glad to hear that. Navigate to the Account page in Organizedly and open the tab end-to-end encryption. A dialog is opened where you need to enter a password. Please store this password in a safe place.

Performance considerations

While end-to-end encryption has multiple benefits, it causes more work for your browser to encrypt and decrypt your data. This means slightly longer loading times and more usage of computational power. What wouldn't we do for increased security?