// Trust & Security Report
RemNote Inc.
RemNote is a consumer/student note-taking and spaced-repetition flashcard app (web, desktop, iOS/Android) with AI study features (AI flashcards, quizzes, summaries, tutor chat, lecture recorder). Tiers are Free, Pro, and Pro with AI, plus an EDU discount; there is no separate enterprise/business product line.
Certifications held
0
Maturity
Startup
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 9 unconfirmed / not-held certifications
source: remnote.comNo public evidence. No trust center, security page, or SOC 2 report/badge found on remnote.com, help.remnote.com, or forum.remnote.io after searching the site and the web.
source: remnote.comNo public evidence. No ISO 27001 certificate, badge, or mention found on any RemNote-owned page.
source: help.remnote.comNo public evidence of an explicit GDPR compliance statement, EU representative, or standard contractual clauses. RemNote publishes a general privacy explainer ('Privacy of Your Notes') describing encryption and data-sharing practices, but it does not reference GDPR, lawful bases, or data subject rights by name.
source: remnote.comNo public evidence. RemNote is a consumer study/note tool, not marketed for health data, and no HIPAA language or BAA offering appears on any vendor page.
source: remnote.comNo public evidence. Subscription payments are processed via standard third-party billing; no PCI DSS attestation is published by RemNote.
source: remnote.comNo public evidence of any ISO 270xx family certification beyond the base ISO 27001 (also unheld).
source: remnote.comNo public evidence. No AI-governance certification is mentioned anywhere on RemNote's site.
source: remnote.comNo public evidence. RemNote is a consumer/student product with no government or federal offering found.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
United States (data hosted in MongoDB Atlas on AWS infrastructure per RemNote's own help center article). No dedicated EU/regional data residency option was found on any vendor page.
RemNote's help center states: 'We do not train any AI models using the text of your notes, nor do we allow third parties to do so.' AI features (flashcard/quiz generation, tutor chat, explanations) send note snippets to third-party model providers (OpenAI, Anthropic, Google Gemini, Groq, Replicate, Cerebras, DeepInfra, OpenRouter) for processing only; bullets marked 'Super Private' are excluded, and the 'Use AI Features' toggle can be disabled in Settings. Separately, RemNote's Terms of Service (as captured) grant RemNote a 'world-wide, perpetual, royalty-free license... to use, copy, reproduce, process, adapt, modify, publish, transmit, display, and distribute' user-submitted content, which is broader boilerplate hosting/service language, not an AI-training grant, but AIFOXX should flag the breadth of that clause to users evaluating sensitive-note privacy.
// Security controls
Encryption at rest
Data encrypted at rest on RemNote's servers (MongoDB Atlas / AWS). No end-to-end encryption is offered; RemNote states it is 'considering' E2EE as a future feature.
help.remnote.comStaff access controls
Access to systems storing user notes is restricted to a small number of employees; staff cannot view notes without explicit user action (temporary Support Access auto-revoked after 60 days, exported copies, or public sharing).
help.remnote.comData monetization
RemNote states it will never sell or monetize user data; revenue comes from subscriptions.
help.remnote.comThird-party subprocessors (non-AI)
DuckDuckGo (favicon lookups, domain names only), CloudConvert (document conversion, files deleted within 24 hours), Wikimedia Commons (concept names only, for image search).
help.remnote.comOffline / local-only mode
Users can keep a knowledge base local-only, preventing any server transmission, at the cost of cross-device sync.
help.remnote.comStatus / uptime transparency
Public status page exists at status.remnote.com (uptime/incident history), though this is an operational signal, not a security certification.
status.remnote.com// Products & data scope
data: Personal notes, flashcards, limited PDF annotation (3 PDFs), limited AI credits (100/month)
Entry tier; same underlying infrastructure and privacy practices as paid tiers.
data: Personal + shared knowledge bases, PDF annotation, image occlusion, exam scheduler, handwritten notes, 1,000 AI credits/month
$8/month or $96/year. Pro users can create and share synced knowledge bases with collaborators.
data: Same as Pro plus lecture recorder, AI grading, AI chat, image-to-text, 20,000 AI credits/month
$18/month or $216/year. No distinct enterprise-grade data controls beyond the AI toggle; a Team/Enterprise plan with SSO or admin controls was not found.
data: Same product surface as Pro/Pro with AI tiers, discounted for students
Referenced in site navigation ('EDU') but no distinct pricing or data-handling terms were found; treat as a discount program, not a separate compliance tier.
// What to watch
- No trust center, security page, or compliance certifications (SOC 2, ISO 27001, HIPAA, etc.) were found anywhere on RemNote's own domains after direct search and fetch; this is consistent with RemNote's identity as a small, venture-backed ($2.8M raised) consumer study app, not evidence of misrepresentation.
- The captured Terms of Service page (forum.remnote.io/tos) contains unfilled template placeholder text (e.g., '{{governing_law}} will govern any dispute', '{{city_for_disputes}}') instead of an actual jurisdiction/governing-law clause. This looks like an incomplete or stale legal document and should be verified live before citing it authoritatively; AIFOXX should not treat this ToS snapshot as fully reliable.
- RemNote's help-center privacy article promises no AI-model training on note text, but its Terms of Service (as captured) also grant RemNote a broad 'world-wide, perpetual, royalty-free' license to use/adapt/publish user content; this is standard hosting boilerplate rather than a training grant, but the breadth of the clause is worth surfacing to privacy-sensitive users.
- Legal entity name is confirmable on a vendor-owned page: the remnote.com homepage footer states '© 2026 RemNote Inc.'; third-party registries (Crunchbase/PitchBook) list RemNote as Delaware-incorporated, headquartered in Wilmington, DE. (An earlier draft incorrectly claimed no vendor page states the formal entity name.)
- No DPA (Data Processing Agreement) or GDPR-specific compliance page was found; this is a real gap for any EU business customer, not just an evidence-capture gap, since a search across the vendor's own site produced no such document.
// At a glance
Pricing model
Freemium subscription: Free, Pro ($8/mo), Pro with AI ($18/mo), plus an EDU student discount. No enterprise/per-seat business plan found.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on RemNote Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
remnote.com