Standard Notes is an end-to-end encrypted note-taking app operated by Standard Notes Ltd., a US-based company acquired by Swiss privacy firm Proton AG in April 2024 and run as a separate product. Note contents are encrypted on-device before syncing; the company states its server can read only metadata such as an item's creation and modification dates and its content type. Account creation requires an email address, which the privacy policy says is used for notifications and marketing (opt-out available). The apps contain no analytics beyond error reporting, and the website runs self-hosted Plausible analytics. Subprocessors include AWS, Cloudflare, Stripe, PayPal, Coinbase, and Zendesk. Client apps (AGPL-3.0) and the server (GPL-3.0) are open source, and the company publishes four third-party security audits conducted between 2017 and 2022 by Shackle Labs, Cure53, and Trail of Bits.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
Standard Notes' privacy policy (undated, live as of 2026-08-01) states that account creation requires an email address which is used for notifications and for marketing purposes (with an opt-out), that data is encrypted on the user's device before syncing, and that the applications collect no location-based information or usage data.
Standard Notes' help documentation states that while its sync server cannot read note contents, it can read each item's creation and modification dates and its content type (note or tag); it also states IP addresses are temporarily remembered for up to 5 minutes by an AWS-based firewall for rate limiting, and that database backups persist for 14 days after account deletion.
The privacy policy live at standardnotes.com as of 2026-08-01 — not a Proton AG policy — governs the product, and names Standard Notes Ltd., based in the United States, as the operating company, with services governed by U.S. law.
In a blog post dated 2024-04-10, Standard Notes announced it was joining forces with Proton (the Swiss organization behind Proton Mail), stating that Standard Notes will continue to be open source, continue to undergo independent audits, and continue to operate independently as a separate product.
Proton's announcement of 2024-04-10 confirmed that Standard Notes, an end-to-end encrypted note-taking app with over 300,000 users, was joining the Proton ecosystem, and committed that it would remain open source and freely available with existing subscriptions honored.
Proton's announcement of 2024-06-17 established the non-profit Proton Foundation as the largest voting shareholder of Proton AG — the company that acquired Standard Notes two months earlier — with the foundation able to block any change of control.
Standard Notes' help documentation enumerates the external services used in daily operation — Amazon Web Services for servers and databases, Stripe and Braintree/PayPal for payments, Amazon Simple Email Service for transactional emails and campaigns, GitHub for source code and desktop-download CDN, and Proton for Business for support email — and states no Mailchimp-style marketing service is used.
Standard Notes' privacy policy (undated, live as of 2026-08-01) lists data subprocessors including Amazon Web Services, Cloudflare, Stripe, PayPal/Braintree, Coinbase, GitHub, and Proton Mail, notes that support email is integrated with Zendesk, and states that the limited user data collected is disclosed only under a valid and binding request from competent U.S. authorities — and that end-to-end encrypted content cannot be decrypted or produced.
Cure53's published summary report on Standard Notes' authentication, backend, API and server, covering testing performed 08.-09.2022, lists 16 findings (one critical, one high, six low, the remainder informational or miscellaneous) across four white-box work packages against the standardnotes/server and standardnotes/app repositories, and records for multiple findings that Standard Notes shipped a fix which Cure53 then verified by inspecting the corresponding pull request or diff on GitHub.
Standard Notes' help documentation, live as of 2026-08-01, lists four completed third-party security audits covering its full ecosystem: a Shackle Labs cryptography design review (2017), a Cure53 full-ecosystem penetration test (2019), a Trail of Bits client-side protocol and encryption assessment (2020), and a Cure53 server backend penetration test and security assessment (2022), with report links published.
Standard Notes publishes a vulnerability disclosure policy in the SECURITY.md of its main application repository, defining a security@standardnotes.com reporting channel, an in-scope statement covering security issues in any current release, an explicit list of out-of-scope bug classes (already-reported issues, upstream dependency bugs, attacks requiring physical device access, self-XSS, outdated versions), and prohibited research activities including denial of service, spamming and social engineering. The policy asks for coordinated disclosure but does not offer monetary rewards.
Trail of Bits' published security assessment of Standard Notes, dated 2020-03-09, reviewed the SNJS and SNCrypto libraries and encryption protocol version 004, reporting one medium-severity issue and three informational findings, and concluded the protocol design was robust with no design-level findings.
In a blog post dated 2021-01-05, Standard Notes announced that its then-new encryption release (XChaCha20-Poly1305 for data encryption and Argon2 for password-based key derivation) was backed by two commissioned security audits — a multi-week Cure53 penetration test of the entire ecosystem including cross-platform applications and server, and a Trail of Bits audit of the specification, algorithms and code of its shared encryption and sync library.
The Apple App Store privacy label for the Standard Notes iOS app (developer: Standard Notes Ltd.), as displayed on 2026-08-01, is 'Data Not Collected', indicating the developer has declared that it does not collect any data from the app, including data used to track users.
Standard Notes' help documentation states that the company does not use analytics in its web, desktop, or mobile applications, and that its guest-facing website uses self-hosted, privacy-respecting Plausible analytics rather than a third-party analytics service.