Security & architecture
Last updated 13 October 2026.
The answers to a typical security review, in pictures and short facts. The details of what we store and why are in our privacy policy. Questions or a security report: support@cloudcircus.com.
How data flows
Everything runs on one server in Germany. The database and live-update service can't be reached from the internet; only the web server can.
What leaves your mail client
When you open an email with mailnote, the add-in sends our server that email's headers, to find the notes on its thread. The body and attachments are never read or sent, and the add-in can't see other emails.
Confidential emails
If an email's subject contains the word "confidential" or "secret", mailnote
never sends or stores that subject. It uses *** confidential *** in its place, with a one-way hash of
the real subject as a reference.
In your mailbox
Confidential: acquisition of Nordic Freight
What mailnote sends and stores
*** confidential ***
+ SHA-256: 2d8585fb…8bf38759
Which subjects?
Any subject with the word "confidential", "confidentiality", "secret" or "secrets", in any upper or lower case: "CONFIDENTIAL: Q3 numbers", "Re: our secret plan", "Top-secret". Words that only contain them, such as "secretary", don't count.
Outlook
The add-in masks the subject in Outlook, before anything is sent: the real subject never reaches our server. The rest works as usual (sender, recipients, date and Message-IDs), so notes still find their thread.
Gmail
Google gives our server the open email's headers, so here our server masks the subject the moment it receives it, before it's used for anything. The real subject isn't stored or logged.
The hash
A SHA-256 hash of the subject is kept as a reference: the same subject always gives the same hash, but the subject can't be read back from it. Someone who already knows the exact subject could confirm it matches.
What you see
Everywhere mailnote shows an email's subject (the web app, the add-ins, IFTTT), these emails show "*** confidential ***". Notes themselves are unchanged: what members write in a note is up to them.
What it costs
mailnote can't suggest related notes from these subjects' words (it still does by customer, project and people), and Outlook's "Find in Outlook" searches by sender only.
Where it's stored
Nuremberg, Germany
Hetzner Online GmbH, a German hosting company, data centre park Nuremberg (nbg1), in an ISO/IEC 27001-certified data centre. All of mailnote's data is stored and processed there: notes, history, accounts, email details and logs. The encrypted backups are kept in a second Hetzner data centre, in Falkenstein, Germany.
Facts
Is data encrypted in transit?
Yes. HTTPS only (TLS by Caddy, certificates from Let's Encrypt), with HSTS for a year, so browsers never use plain HTTP. The app talks to the database over a private network on the same server. Emails we send use TLS when the receiving server supports it, and are signed (DKIM, SPF, DMARC).
Is stored data encrypted?
Yes. The database lives on a LUKS-encrypted disk volume (AES-256), so disks and snapshots at the hosting company are unreadable on their own. Backups are encrypted too. On top of that, passwords and tokens are stored hashed, and two-factor secrets encrypted.
Who can see the notes?
Only members of the organisation they were written in. Owners and admins decide who is a member. Every read and write checks membership; anyone else gets "not found", and our tests check that for every endpoint.
Who at CloudCircus has access?
Only Ruben Nørgaard, CloudCircus's founder, has administrative access to the server and the database. Nobody reads your content unless you ask us to (for support), it's needed for security, or the law requires it.
Where is data processed?
On the same server in Germany. We use no AI services: suggestions of related notes are rules and full-text search in our own database. Members can connect their own AI assistant only if an owner allows it (see below).
What do we use it for?
Only to provide mailnote. No ads, no selling of data, no training of AI models, no profiling.
Are email bodies stored?
Never. We keep the subject, people, date and Message-IDs of an email only while a note is attached to it.
Confidential subjects?
Masked: a subject with "confidential" or "secret" is never sent or stored. See confidential emails.
Does data leave the EU?
Your organisation's data is stored in Germany. It leaves the EU only in the cases listed under other companies: the Gmail add-on (through Google), sign-in with Microsoft or Google if you choose it, a Gravatar lookup (an email hash only), IFTTT if a member connects it, and an AI assistant if the organisation allows it and a member connects one.
Backups?
Every night, encrypted on our server (age, public-key encryption: the key to decrypt them is kept offline, never on the server) and copied to a Hetzner Storage Box in Falkenstein, Germany. Kept 30 days. Restoring them is tested.
How long we keep data
| Data | Kept |
|---|---|
| Notes, customers, projects | Until a member deletes them, or the organisation is deleted. |
| History of changes (earlier versions of notes) | Until the organisation is deleted, also for notes deleted since, so a changed agreement can always be traced. |
| Email details (subject, people, date, Message-IDs) | Until the last note on that thread is deleted or unlinked. |
| Emails you open without notes | Not stored: a lookup stores nothing. |
| Server logs (IP address, requested page) | 30 days. |
| Outlook add-in sign-ins | 90 days, or until you sign out (Settings can sign out everywhere). |
| Invites | The link expires after 14 days. |
| Gmail connection | Until you disconnect, sign out in Gmail or change your password. |
| IFTTT connection | Until you disconnect it in Settings. |
| AI assistant connection | Until you disconnect it, change your password, or don't use it for 90 days. |
| Backups | 30 days. |
| Your account | Until you ask us to delete it at support@cloudcircus.com. |
AI assistants (MCP)
mailnote itself uses no AI. Organisations can choose to let members use their own AI assistant (Claude, ChatGPT, or any app that speaks the Model Context Protocol) with mailnote.
Off until an owner turns it on
Per organisation, in its settings, by an owner. While it's off, a connected assistant sees nothing of that organisation. Turning it on and off is in the history.
What an assistant can do
As the member who connected it: read notes (with history), customers and projects; add and edit notes, mark action items done, add customers and projects. It can't delete anything, or touch members, invites or settings. Every change goes through the same rules and is marked “through an AI assistant” in the history.
What it never gets
Email bodies (we don't have them) and email addresses: people appear by name, and people on emails by name and domain.
How it signs in
OAuth 2.1 with PKCE: the member logs in on mailnote (two-factor authentication applies) and allows the app. Access tokens last an hour; refresh tokens rotate on every use, and a reused one ends the connection. A password change ends it too. Members see and disconnect their assistants in Settings.
Other companies
Which companies get a copy of any data, and when.
| Company | What and when | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting: stores all data (our server). | Germany |
| Only if you use the Gmail add-on: Gmail shows our cards, so the notes in them (titles and details) pass through Google. And sign-in with Google, if you choose it. | Global | |
| Microsoft | The Outlook add-in runs inside Outlook and loads Microsoft's Office.js from Microsoft's network. Sign-in with Microsoft, if you choose it. No notes are sent to Microsoft. | Global |
| Automattic (Gravatar) | Our server asks for a profile picture with a SHA-256 hash of your email address. Your browser never contacts Gravatar. You can turn it off in Settings. | USA |
| IFTTT | Only if a member connects it: the notes of that member's organisations, as described on our privacy page. | USA |
| An AI assistant's provider (e.g. Anthropic, OpenAI) | Only if an owner allows AI assistants and a member connects one: what that assistant reads, as described above. | Depends on the provider |
| Recipients' email providers | Invites and account emails we send. Never note content. | Wherever the recipient's email is hosted |
| Let's Encrypt | Issues our HTTPS certificates. No data. | USA |
| one.com | Hosts our domain's DNS. No data. | Denmark |
Passwords & two-factor authentication
Passwords
Hashed with PBKDF2-SHA256, 1,000,000 iterations. At least 8 characters, not a common password, not all numbers and not similar to your email address. We never store or see them in plain text.
Two-factor authentication
Anyone can turn on an authenticator app (with recovery codes) in Settings. Owners can require it for every member of their organisation. It applies to every way in: the web app, the Outlook and Gmail add-ins and IFTTT and AI assistants, which all sign in through the same login.
Login protection
Failed logins are rate limited (10 a minute per IP address, 5 per 5 minutes per account). Email addresses must be confirmed, and signups have bot protection. You can also sign in with Microsoft or Google.
Tokens and links
Invite links, Gmail connect links, Outlook sign-in codes, IFTTT and AI assistant tokens are stored only as hashes. Two-factor secrets are stored encrypted. Invites can only be accepted by the invited, confirmed address. Signing out everywhere (Settings) ends every Outlook sign-in at once.
Browser protection
No page can be framed by other sites, except the Outlook pane, which only Outlook may frame. Strict security headers (Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy) and secure, HTTPS-only cookies.
Reporting a problem
Found a security issue? Email support@cloudcircus.com.