how encryption works

Plaintext never leaves your device.

Mark a note private and it's encrypted in your browser before it touches the network. Your organisation's master key rotates on a schedule you set. We hold ciphertext.

/ 01
Derive
Org master key derived from passphrase via PBKDF2-SHA256, 600 000 iterations, 32-byte output.
/ 02
Encrypt
Per-note AES-256-GCM with random 96-bit IV. Authenticated encryption — tampering is detectable.
/ 03
Transit
TLS 1.3 to UK data centres. Ciphertext over the wire. HSTS preload. HTTP/3.
/ 04
Rest
Stored encrypted at rest in MariaDB Galera. Server holds opaque blobs. Backups encrypted independently.
data residency

Choose where your data sleeps.

Default tenancy is the United Kingdom. Team and Enterprise customers can elect for dedicated tenancy in the EU or US. You pick. We honour it.

United Kingdom London + Manchester · MariaDB Galera HA all tiers live
European Union Frankfurt · dedicated tenancy enterprise soon
United States Virginia · dedicated tenancy enterprise planned
honesty section

What's certified, what's coming.

We don't bluff badges. Here's our current posture and the roadmap. The big ones land in the next twelve months.

Standard Status Notes
UK GDPR data protection act 2018 compliant Lawful basis · DPIA · DPA available
EU GDPR regulation 2016/679 compliant EU SCCs in place · Frankfurt tenancy
Cyber Essentials uk ncsc baseline in progress Target: Q3 2026
ISO/IEC 27001 information security management in progress Target: Q4 2026
SOC 2 Type II aicpa trust services criteria planned Target: 2027
— responsible disclosure: [email protected]  ·  existing customers: support.ether-x.com

Still have questions?

Talk to a human. We answer security and procurement questions ourselves — no sales gating, no chatbot.

Email [email protected]