Reporting vulnerabilities

If you find a security vulnerability in Noteway, tell us. This page explains how.

How we protect your data

This description is general. We do not publish security details. The vulnerability reporting policy is below.

Signing in
You sign in with Apple, Google or an email and password. Passwords are hashed and checked against known leaks.
Separate accounts
The database makes sure every account sees only its own data.
Audio files
Recordings sit in private storage. You download them with links that work only briefly.
Encryption
Connections are encrypted. Sensitive fields, such as integration keys, have extra encryption.
Sessions and devices
In Settings you see signed-in devices and can sign them out.
Deletion
Deleting your account starts erasing data from the database and storage. Backups expire within 30 days.

Describe the issue, the steps to reproduce it and the possible impact.

Don’t include other people’s personal data.

You can write in Polish or English.

The contact details are also in security.txt.

The Noteway apps for iOS and Android, the noteway.app website and our servers.

Out of scope: denial of service, social engineering, spam and physical access to devices.

Report issues in our providers’ services directly to them.

Test only with your own account and your own data.

Don’t read, change or delete other people’s data. If you come across it, stop and tell us.

Don’t overload our services or run automated scans without agreeing it with us.

Give us time to fix the issue before you publish details.

If you act in good faith under these rules, we won’t take legal action.

We also won’t report testing done under these rules to law enforcement.

We confirm receipt within 3 working days.

We share our assessment and fix plan within 10 working days.

We report actively exploited vulnerabilities to the competent authorities.

We send an early warning within 24 h and a full notification within 72 h.

If you need to act, for example update the app, we will tell you.