Last updated: September 21, 2026
Node holds things people would rather keep to themselves. This page says, in plain terms, how it is protected and what to do if you find a problem.
Everything between your device and Node travels over TLS, including the live connection that syncs edits as you type. The app refuses to run over plain HTTP.
Your password never reaches Node. You sign in at your Attereon account, which hands the app a short-lived signed token; Node verifies the signature against the account service's published keys on every request and never trusts the token's contents otherwise. Tokens expire in minutes and are renewed quietly while you use the app. Signing out everywhere at your Attereon account ends every Node session within that window, including the live connections.
Access to anything is checked on the server for every request, live edit and background job — not in the app. What you share is exactly what the other person can reach: an editor can change it, a viewer can only read it, and neither can move it, re-share it, or delete it. Removing someone takes effect at once, on the devices they have open too.
Attachments are stored under random, unguessable names and served only from those addresses, with browsers told never to run them. A file you delete is gone from the server; shared caches are told not to keep copies.
An AI app you connect works through its own scoped token, starts with access to nothing, can only see the projects you grant, cannot delete anything or change who you share with, and everything it does is logged in your Activity feed with an undo. Disconnecting it revokes the token immediately.
Node runs on a single server we operate. Anything a person sends is checked for shape and size before it is stored, notes are sanitised so nothing that could run as code survives, and each account can only use its own share of the server's capacity. Backups are taken nightly, encrypted before they leave the machine, and stored off-site; restores are rehearsed.
If you believe you have found a security issue, email [email protected] with what you saw and how to reproduce it. A person reads it, you will hear back within two business days, and we will not take action against anyone reporting in good faith.