Security

An overview of how Notara protects your data. Full technical documentation is maintained in the project repository.

Per-user data isolation

Every meeting, recording, transcript, note, action, document and knowledge item is scoped to the account that created it. This is enforced with Row-Level Security at the database level — not just filtered in the app — so one account can never read another's data, even through a bug in a client application.

Authentication

Notara uses industry-standard authentication (email/password, magic links, and Google sign-in) with secure session handling and refresh.

File storage

Recordings and documents are stored in per-user-scoped storage. Private files are never exposed through public URLs — access goes through signed, time-limited links only.

Third-party integrations

Optional OAuth connections to Google Calendar and Google Drive request only the minimum access needed. Long-lived Google refresh tokens are held server-side only and are used to mint short-lived access tokens; a short-lived access token is cached in the browser for the duration of a session to make requests. Microsoft OneDrive is planned and not yet available.

Reporting a concern

If you believe you've found a security issue, please contact us (see the Contact page) rather than disclosing it publicly. We take reports seriously and will respond.