# Data Security & Compliance Trust Ideanote to keep your data secure and meet your compliance requirements. **Secure Access** Ideanote supports SSO through SAML 2.0, SCIM provisioning, domain claiming, and device management integrations so only approved users and trusted devices ever reach your workspace. **Easy Compliance** All customer data in Ideanote is encrypted both in transit and at rest by default. Enterprise admins gain additional visibility and control with audit logs, advanced permission settings, and integrations with audit log aggregators to safeguard your information. **Information Control** Features such as global retention policies, export controls, and audit trails help organizations manage compliance obligations and maintain oversight across the full lifecycle of their ideas. **Hosting Options** Ideanote offers standard cloud hosting, regional data residency, dedicated single‑tenant deployments, and fully self‑managed on‑premise installations—giving you control over where and how your data is hosted. ## Trust Speaks Louder than Words With a **98% score on SecurityScorecard**, Ideanote ranks among the most secure platforms worldwide. This top-tier rating confirms our strong defenses, continuous monitoring, and low-risk profile. **FLEXIBLE CONTROL** Ideanote has been audited against and found compliant with SOC 2 security, availability, and confidentiality principles by an independent auditor. ## Security We take a security-by-design approach to protect your data. Our infrastructure, policies, and processes are continuously monitored to ensure compliance with industry standards. ### Encryption Everywhere All data that flows through Ideanote is encrypted using strong cryptography both when it is sent across the internet (TLS 1.2+) and when it is stored in our databases or file systems (AES-256). This ensures that your data is protected against unauthorized access. ### Least-Privileged Access Access to customer data is granted only when strictly necessary and always limited to the minimum required. Every employee has unique accounts, multi-factor authentication is enforced, and terminated accounts are automatically removed within one business day. ### Continuous Monitoring Our infrastructure, endpoints, and policies are monitored around the clock. Automated alerts and daily evidence collection ensure that security controls are active every single day. ### Secure Development Lifecycle Our software development lifecycle (SDLC) includes multiple safeguards. Every code change undergoes peer review, automated testing, and security scans before release. Dependencies are continuously checked for vulnerabilities, ensuring secure practices from code creation to deployment. ### Clear Reporting Structure We maintain documented internal processes and external contacts so vulnerabilities and incidents can be reported and addressed quickly and transparently. ### Secure Authentication Ideanote supports multiple enterprise‑grade authentication methods, including SAML 2.0, SCIM, JWT, OpenID and more. ## Privacy Your data stays yours. We design our platform and policies to ensure confidentiality, transparency, and compliance with global standards. ### How we Handle your Data Our team maintains data privacy safeguards that align with industry best practices. We provide ongoing training to ensure our employees are up to date with evolving legislation and privacy standards. ### Agreements The Ideanote Terms and Data Processing Addendum describe in detail our data privacy practices, standards, and safeguards. ### Data Governance We apply policies and procedures that govern the entire data lifecycle from collection and processing to distribution, storage, and deletion. ### Security infrastructure Ideanote’s infrastructure is designed with layers of protection to help ensure your data is secure while transmitted, stored, or processed. ## Compliance We align with leading frameworks and undergo independent audits to provide assurance that your data is handled responsibly. ### SOC2 Type II Our systems and controls are audited against the AICPA Trust Services Criteria, verifying that Ideanote maintains effective safeguards. ### GDPR Compliance Ideanote maps our privacy program to GDPR requirements and other international regulations. ### Data Residency Options Ideanote supports the EU, US, CA and AE regions for data residency to comply with regional regulations. ### On-Premise Hosting Ideanote offers fully self‑managed installations for organizations with strict compliance or security mandates. ## Reliability Innovation requires a platform you can depend on. Ideanote is built with resilience and continuity in mind. ### Automatic Load Balancing Load balancing and a clustered architecture ensure high availability. ### Backup and Retention All databases are backed up daily, with versioned storage and defined retention periods. ### Cloud Monitoring and Alerts Core infrastructure, including databases and messaging queues, is continuously monitored. ### Business Continuity A tested disaster recovery and business continuity plan ensures services can be restored quickly. ## AI Governance AI in Ideanote is built to help you work smarter without adding risk or complexity. ### No Training on Customer Data Ideanote does not use customer content to train AI models. ### Regional AI And Data Residency AI processing stays in-region alongside your workspace data to meet internal expectations. ### Enterprise Security And Isolation AI data is processed in infrastructure designed for confidentiality and compliance, with encryption and isolation built in. ### Zero Logging And Zero Retention We ensure that prompts and completions are not stored or reviewed. ### Fine-Grained Control AI is optional and configurable, allowing teams the benefits of AI without exceeding internal policies.