Security

What protects your account, your audio and your notes, and what we will do next.

• Encrypted connections

  Every page and request goes over HTTPS. A visit by plain HTTP is sent to HTTPS, and browsers are told to use HTTPS for six months.

• Strict browser rules

  Each page sets a content security policy, refuses to be framed by other sites, sends no referrer beyond the site's own address to Google's file picker, and asks for the microphone only on SaysHere itself.

• Sign-in without a password

  Sign in with a code sent to your email, or with Google or GitHub.

• Your notes stay on your device

  Notes are kept in your browser, not on our server.

• Payments through Stripe

  Card details go to Stripe's checkout page and never reach our server.

• Little logged

  Our server logs record events and counts, never what anyone said or wrote.

• Independent audits: planned

  We are scheduling an outside penetration test and an independent code review. We will publish what they find, and what we fixed, on our blog.

  Read the post: Security at SaysHere, and the audits we are scheduling