Security and data handling
Data handling sheet
For security, privacy and procurement reviews. It describes what ScriptumIQ does today — including what it does not yet do. The plain-language version is the privacy policy; both form part of the terms.
In one paragraph
ScriptumIQ reads the reMarkable notebooks a customer chooses, using Anthropic's Claude API, and writes a planner, an action list and notes back to the tablet. Page images are kept by ScriptumIQ for about a day, encrypted. What is read from them is kept for as long as the account exists so the lists can be updated each night, and all of it is encrypted in the database. Neither ScriptumIQ nor Anthropic trains AI models on customer content. Anthropic deletes what it receives within 30 days.
1. AI processing
- Provider: Anthropic, Claude API, under Anthropic's commercial terms, acting as processor. Models: Claude Sonnet, with Claude Opus re-reading only pages read with low confidence.
- Provider assurance: Anthropic's certifications (including SOC 2 Type II and ISO 27001) and its compliance reports are available from the Anthropic Trust Portal.
- Sent for each changed page: the page image (1568 px long edge); the notebook name and page number; the date and timezone; the customer's ink conventions, lexicon and handwriting sample.
- Sent at setup: the customer's role, industry and free-text context, to write a handwriting-sample passage; the image of the written sample.
- Not sent: account ids, email addresses or any other identifier — no request carries user metadata. The shared news brief and daily puzzle carry no customer content.
- Training: none. Anthropic does not train on API data without express permission, and ScriptumIQ has given none. ScriptumIQ trains no models.
- Retention at Anthropic: up to 30 days for API requests; the overnight read uses Anthropic's Message Batches API, whose jobs are kept 29 days. Content flagged by Anthropic's usage-policy systems may be kept longer. Prompt caching holds data in memory only, for at most an hour.
- Zero data retention: not in place. The overnight batch is not eligible for it; moving the overnight read to the standard API, which is eligible, and putting a zero-retention agreement in place is planned.
2. What ScriptumIQ stores
| Data | Where | Encrypted at rest | Retention |
|---|---|---|---|
| Downloaded notebook pages, rendered page images, generated documents | Server disk cache | Yes — AES-256-GCM | Deleted by the next nightly run (≈24 h); 48 h failsafe sweep |
| reMarkable device token | Database | Yes — AES-256-GCM | Until the tablet is unpaired or the account deleted |
| Meeting-note text, daily Notes, notes on calendar entries | Database | Yes | Until the customer deletes the item or day, or the account |
| Handwriting calibration image | Database | Yes | Until replaced or the account deleted |
| Last reading of each page (for 'what is new') | Database | Stored as keyed word hashes, never text | Until the account is deleted |
| Action text, projects and people; calendar titles / places / attendees; Inbox items; meeting titles and attendees; meetings to set up | Database | Yes — AES-256-GCM, column by column | Until the customer drops the item, or the account is deleted |
| Corrections, lexicon, role / industry profile, settings, notebook names, feedback comments | Database | Yes — AES-256-GCM | Until the account is deleted |
| Email address, timezone, password | Database | Password: salted scrypt hash only | Until the account is deleted |
| Email log (recipient; subject, which carries the meeting title) | Database | Subject: yes. Recipient: no | Until the account is deleted |
| Run history, token counts, costs | Database | No (no content) | Until the account is deleted |
| Operator reading-accuracy reports (operator's own account only) | Server disk | Yes | Deleted within 24 h |
| An email we are sending you (address, subject, body, attachments) | Database | Yes — AES-256-GCM | Until it is sent, at most 24 hours; a record that it went, without address or content, 30 days |
| Email sent to admin@ or support@ (sender, subject, text, attachments, the operator's assessment of it) | Database | Yes — AES-256-GCM, the whole message | 90 days; 30 days once moved to the trash; or until the operator empties the trash |
| Deletion audit record (actor, time, email) | Database | No | Kept after deletion, as the record that it happened |
| Database backups (everything above that lives in the database) | Server disk; optional off-server copy | Yes — the encrypted columns again, inside an AES-256 encrypted dump with its own key | 7 days, then deleted; each backup is verified as restorable when it is made |
Content is encrypted by the application before it is written, so the database, its files and its backups hold only ciphertext. Encryption uses one server-wide AES-256-GCM key held in the server's environment, not in the database, the backups or the code. There are no per-customer keys: with the key in one place, a key per customer stored beside the data would protect nothing more, and deletion is bounded instead by the seven-day backup window. The database runs on the same server as the application, publishes no network port, and is reachable only by the application.
3. Processors
| Processor | Purpose | Data handling |
|---|---|---|
| Anthropic (Claude API) | Reads page images; also writes the handwriting-sample passage and the shared news brief, and assesses an email sent to support@ or admin@ when the operator asks it to | No training on API data without express permission. API data deleted within 30 days; overnight batch jobs within 29 days; usage-policy-flagged content may be kept longer. No zero-retention agreement in place. |
| reMarkable | Source of the notebooks; destination of generated documents | The customer's own reMarkable cloud account and terms. |
| Resend | Sends sign-in links, meeting-note emails and chosen PDFs; receives forwarded calendar invites and email to admin@ and support@ | Email content passes through Resend under its data-processing terms. |
| Stripe | Subscription billing on Stripe-hosted pages | ScriptumIQ stores plan and status, never card data. |
| Hostinger | Virtual server running the application and database | Single server; database not exposed to the internet. |
4. Access and authentication
- Customers sign in with a password and then a single-use link mailed to them; a session is created only from that link. Five wrong passwords lock the address for 15 minutes; twenty lock the network address.
- Passwords are stored as salted scrypt hashes; reset links are single-use, expire in 30 minutes, and sign nobody in.
- The operator portal is separate from customer sign-in: its own credentials, a six-digit code mailed for each sign-in, short sessions, rate limiting, and an append-only audit log of every operator action. It shows account status, counts, costs, ratings and comments — not note content.
- All traffic to the service is HTTPS. The mobile app holds its session in the phone's secure keychain.
- One store-review demo account, holding only invented data and no tablet, signs in without the emailed link so app-store reviewers can test the app.
5. Logging
Server logs carry counts, ids and hashes — "6 pages, 11 tasks" — never page text, item text or notebook names. Forwarded calendar invites are not logged.
6. Customer controls and deletion
- Choose which tablet folders are read; ebooks are never read, PDFs only on request.
- Drop any action, delete any meeting note or day of Notes, from the website or the app.
- Email goes only to the sign-in address and one delivery address the customer typed and confirmed — never an address read from a page.
- Account deletion (website) cancels the subscription and immediately deletes the account, everything read from the pages, cached files and the device token. The deletion's own audit record is kept. Notebooks on the tablet are never touched.
7. Known limitations
- One encryption key for all customers, held on the server; no per-customer keys and no hardware key management.
- No zero-retention agreement with Anthropic; batch jobs are kept there for 29 days.
- Account ids, email addresses and timestamps are not encrypted, so the database shows who has an account and when they used it — never what they wrote.
- Single server, single region (Hostinger); no independent security certification (SOC 2 / ISO 27001) yet.
Contact
Security questions and reports: support@scriptumiq.com.