Security

Security at StiqNote

StiqNote runs on Cloudflare's network, with your account, comments and files stored in Western Europe. This page is the short version of how we keep that data safe. The privacy policy and the data processing agreement have the full detail, and both are legal commitments, not just a page.

Where your data lives

• Accounts, teams, comments, logs, review rounds and billing references are stored in a Cloudflare D1 database in Western Europe.
• Screenshots, files, recordings, replays and logos are stored in Cloudflare R2, served only through links that expire after 24 hours (a link shared in a GitHub issue stays valid while the issue is linked to the thread).
• Live updates (new comments, replies, who's online) run through Cloudflare Durable Objects. Nothing is kept there beyond the open connection.

Cloudflare, Stripe, Google, GitHub, Salesforce (Slack), Atlassian, Asana and Automattic are certified under the EU–US Data Privacy Framework; transfers to any sub-processor outside the EEA rely on it or on the European Commission's standard contractual clauses.

Encrypted in transit

All traffic to StiqNote, the extension, the review pages and the no-install guest view, uses TLS: HTTPS and secure WebSockets. Nothing goes over plain HTTP.

What's encrypted in the database

StiqNote itself never sees your card details: they go straight to Stripe. A few things get their own layer of encryption on top of the database:

• Sign-in sessions and API keys are stored only as SHA-256 hashes, never as the token or key itself.
• Integration tokens (Slack, Linear, Jira, Asana, ClickUp, Trello, Notion), Microsoft Teams channel URLs, webhook signing secrets, and a client's review-page token are encrypted in the database, not stored as plain text. GitHub connects through an installed app, so there's no token to store at all.

Signing in without a password

There's no password to leak. You sign in with Google, GitHub, or a one-time code emailed to you:

• Sign-in codes expire after 10 minutes, guesses are limited, and sending or checking a code is rate-limited per address and per network.
• Sessions last 30 days from their last use, and can be revoked by signing out.
• A guest's sign-in through a no-install guest link is scoped to that one link: it can't reach billing, settings, API keys, integrations, team management, or any other team's data, even if the token were copied elsewhere.

Who can see what

• Comments belong to a team. Every read and write checks team membership before anything else; a request for another team's data gets a 404, not an error that confirms it exists.
• Private comments are visible to team members only, never to guests, anywhere: the page, live updates, notifications or email.
• Guests see only the sites they were invited to see, not the rest of the team's work.
• API keys act as the person who made them and can read and reply to a team's comments, but never private ones. A key can be revoked at any time in Settings.
• Console logs, network logs and session replays are visible to team members and the person who posted the report, never to other guests.

Session replay, without recording what you type

Bug reports on Pro and Agency can attach a replay of the last 3 minutes. It's built to never capture what people type:

• Every form field is masked. Password, card, bank account and ID fields record nothing at all, not even how many characters were typed.
• A team owner can turn on Hide all text in replays, which replaces all page text with placeholders.
• Replay never runs on email, banking, social media, chat, video, shopping or payment sites, or on any site or page you hide StiqNote on.
• Anything that looks like a credential, tokens and keys in addresses, anything after #, and tokens, passwords and keys in console messages, is replaced with "[redacted]" before it's saved, in both logs and replays.
• Replay stays in your browser's memory until someone posts a new comment with it attached; you can remove it before posting.

See bug reports for how replay and logs work, and session replay in the help center.

Our sub-processors

The full list, with each one's privacy policy, is in the privacy policy. A paid team gets 30 days' notice by email before a new sub-processor starts, and can object.

Retention and deletion

• Comments, files, recordings and logs stay until someone deletes them, or the team is deleted.
• Session replays are deleted automatically after 30 days on Pro and 90 days on Agency.
• Error reports are deleted after 30 days, and uninstall feedback after two years.
• Deleting your account deletes your account and sessions immediately. A team you own is deleted with its content when no other member is left in it. Deleted data can remain in our database provider's recovery copies for up to 30 days.
• Billing records are kept 10 years, as Belgian tax law requires.

Full detail, plan by plan, is in privacy and your data and the privacy policy.

GDPR and the data processing agreement

Broes Consulting BV, the company behind StiqNote, is based in Belgium and is the data controller for your account. For what your team posts in StiqNote, your team is the controller and we're its processor, under our data processing agreement, which is part of the terms for every paying team. It covers what we process and why, our obligations as a processor, our sub-processors, the security measures on this page, and what happens when a team is deleted. You accept it by taking a paid plan; email support@stiqnote.com for a signed copy.

Report a security issue

If you find a security problem in StiqNote, email support@stiqnote.com with what you found and how to reproduce it. We're a small team, so you'll reach the person who can actually fix it, not a ticket queue. Please don't share it publicly before we've had a chance to look at it.