Trust center
Nota looks after records that matter, so we're specific about what we do today, what we're building next and where the limits are.
What you can count on today
- Official apps stay official.Nothing is installed on anyone's phone and no one's app is replaced. Capture is a linked device each person adds and can see.
- Capture can write and can't read back.The service that archives your messages holds permission to encrypt new records and has no permission to decrypt the archive.
- Records are only ever added.Edits and deletions are new entries that point at the original. A scheduled check confirms nothing has changed, and tampering shows up as a failed check.
- Reading archived messages takes two approvals.Access needs a stated purpose and two approvers other than the requester, covers one person and a date range, and expires in 72 hours. Hosted review is off when you hold your own key.
- Gaps stay on the record.If capture stops, Nota logs it in a permanent, hash-chained coverage log with its start, end and cause.
Who can see what
| Who | Message content | Coverage and integrity records |
|---|---|---|
| Your reviewers and records officers (Supervision) | With an approved, time-limited grant | Yes |
| Your administrators | No | Yes |
| A supervised person | No | Their own status and devices |
| The capture service | Only while processing a message | Writes them |
| Nota staff, today | Denied | Yes |
| Nota staff, with customer-held keys Available, with limits | Can't read your stored records | Yes |
Customer-held keys: what they do and don't change
- With a customer-held key, Nota can't read your stored records. Only you hold the key that opens them.
- Capture still handles each message in memory while it archives it. That step is covered by separate controls, not by your key.
- Withdrawing your key makes your records unreadable, for you and for Nota. You can do this at any time.
- If your KMS key is turned off or taken away, capture stops and a gap is recorded. Messages sent during a gap may not be captured.
- The tool that opens and checks your archive can catch changes and mismatches. It has limits, which the documentation sets out, including that the most recent events can be withheld for a period.
- Nota can't make your stored records unreadable for you. Only you can, by withdrawing your key. When you leave, your stored records aren't deleted yet.
- Hosted review is off. Customer-held keys are available for keys in AWS KMS, with Standard or Attested capture. With Attested capture, capture's keys open only after the environment proves it's running approved software. Your own key never opens for Nota. Google Cloud KMS and hardware security modules are coming.
Attested capture
Attested capture runs in a sealed environment no operator can log in to. Your keys open only after it proves it's running the approved software. It relies on a generally available EC2 and ECS feature within AWS's assurance programs.
What we're building next
- Support for more encrypted messaging channels.
- Legal hold and record-level disposition.
- FedRAMP authorization.
- Stronger protection for who-talks-to-whom details in capture systems.
- Open-source capture connectors, so you can inspect the code that touches your messages.
- A published threat model, continuous fuzz testing of our parsers and an annual independent penetration test with a public summary.
Our release pipeline already produces a software bill of materials and signed build provenance for each release.
What Nota doesn't do
- Nota archives messages and attachments. It doesn't record call audio or video, and it doesn't archive stickers, payments, polls or stories. It counts those so you can see they occurred.
- Capture starts when a person enrolls. Nota doesn't promise earlier history.
- Nota covers the people and channels you enroll. It can't reach accounts you haven't told it about.
- Nota can show that it was connected and working. It can't yet show that every message sent to a custodian reached Nota. We're working on closing that gap.