01
ROOT_KEY
Lives only on the server in a hardware-backed secret store. Used to wrap every user’s KEK and never leaves the vault.
HSM · 256-bit · rotated quarterly
CLOUD · ENCRYPTION
Your notes. Every device. Sealed end-to-end.
Write on your phone, finish on your laptop. AES-256-GCM envelope encryption means even the database only sees ciphertext. Free works on a single device; Premium unlocks every device.
BANK-GRADE VAULT
Every note is sealed before it leaves your device.
AES-256-GCM envelope encryption with a three-key chain. Even the server-side database sees nothing but ciphertext — there is no plaintext on the network, ever.
- AES-256-GCM — NIST-approved authenticated encryption
- Per-note DEK, per-user KEK, server-held ROOT_KEY
- TLS 1.3 transport with certificate pinning
- Zero plaintext logging — even in the audit trail
bits
256
key chain depth
3 layers
server plaintext
0 bytes
KEY CHAIN
Three keys. One unbroken chain.
Each layer wraps the next so a single key compromise never exposes user data. Lose the device, lose the KEK — your notes remain sealed behind the ROOT_KEY.
02
KEK
One Key Encryption Key per user. Sealed by ROOT_KEY and stored ciphertext-only in the database. Decrypts to plaintext only inside a process-local memory boundary.
256-bit · ROOT_KEY-sealed · per-user
03
DEK
Every note gets its own Data Encryption Key. Sealed by your KEK and rotated on every edit so a leaked DEK only exposes a single revision.
256-bit · KEK-sealed · per-note · per-edit
DATA FLOW
What happens when you tap save.
- 01
On-device encrypt
Note plaintext + your KEK seal a fresh DEK → AES-256-GCM ciphertext.
- 02
TLS 1.3 ship
Ciphertext + nonce + tag go to /notes over a pinned TLS 1.3 channel.
- 03
Server stores
Only the ciphertext blob is written to the database. ROOT_KEY never decrypts.
- 04
Other device pulls
The ciphertext flows down. Your local KEK unseals the DEK and decrypts in-memory only.
EVERY DEVICE
Phone, tablet, laptop, web.
Same encrypted notes everywhere. Write once, sync everywhere, sealed end-to-end on the wire.
Android
Material You · stylus-aware
iOS / iPadOS
Apple Pencil ready
Windows
Microsoft Store · MSIX
Web (PWA)
Installable in any browser
Sync across Android, iOS, Windows, Web
Write a note on your phone walking home, open your laptop, the same note is there — synced through Noteminator cloud over TLS 1.3.
Bank-grade AES-256-GCM envelope encryption
Every note is wrapped by its own Data Encryption Key (DEK). Every DEK is wrapped by your Key Encryption Key (KEK). Every KEK is wrapped by the server-side ROOT_KEY.
ROOT_KEY -> KEK -> DEK key chain
A database leak exposes ciphertext blobs and nothing else — there is no plaintext on the server, ever. Anayasa Section 23 enforced at the SQL layer.
Offline-first. Works without the network.
Lose connectivity? Notes continue to save locally. When the network comes back, queued changes sync up — last-write-wins per note.
What you write, only you read.
No ads, no analytics, no plaintext on the wire. The same encryption posture that protects your bank account, applied note-by-note to everything you create with Noteminator.