// Trust & Security Report
RemNote
RemNote is a consumer/student note-taking and spaced-repetition flashcard app (web, desktop, iOS/Android) with AI study features (AI flashcards, quizzes, summaries, tutor chat, lecture recorder). Tiers are Free, Pro, and Pro with AI, plus an EDU discount; there is no separate enterprise/business product line.
Certifications held
0
Maturity
Startup
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 9 unconfirmed / not-held certifications
source: remnote.comNo public evidence. No trust center, security page, or SOC 2 report/badge found on remnote.com, help.remnote.com, or forum.remnote.io after searching the site and the web.
source: remnote.comNo public evidence. No ISO 27001 certificate, badge, or mention found on any RemNote-owned page.
source: help.remnote.comNo public evidence of an explicit GDPR compliance statement, EU representative, or standard contractual clauses. RemNote publishes a general privacy explainer ('Privacy of Your Notes') describing encryption and data-sharing practices, but it does not reference GDPR, lawful bases, or data subject rights by name.
source: remnote.comNo public evidence. RemNote is a consumer study/note tool, not marketed for health data, and no HIPAA language or BAA offering appears on any vendor page.
source: remnote.comNo public evidence. Subscription payments are processed via standard third-party billing; no PCI DSS attestation is published by RemNote.
source: remnote.comNo public evidence of any ISO 270xx family certification beyond the base ISO 27001 (also unheld).
source: remnote.comNo public evidence. No AI-governance certification is mentioned anywhere on RemNote's site.
source: remnote.comNo public evidence. RemNote is a consumer/student product with no government or federal offering found.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
United States (data hosted in MongoDB Atlas on AWS infrastructure per RemNote's own help center article). No dedicated EU/regional data residency option was found on any vendor page.
RemNote's help center states: 'We do not train any AI models using the text of your notes, nor do we allow third parties to do so.' AI features (flashcard/quiz generation, tutor chat, explanations) send note snippets to third-party model providers (OpenAI, Anthropic, Google Gemini, Groq, Replicate, Cerebras, DeepInfra, OpenRouter) for processing only; bullets marked 'Super Private' are excluded, and the 'Use AI Features' toggle can be disabled in Settings. Separately, RemNote's Terms of Service grant RemNote a world-wide, perpetual, royalty-free license to use, copy, reproduce, process, adapt, modify, publish, transmit, display, and distribute user-submitted content, which is broader hosting/service language rather than an AI-training grant.
// Security controls
Encryption at rest
Data encrypted at rest on RemNote's servers (MongoDB Atlas / AWS). No end-to-end encryption is offered; RemNote states it is 'considering' E2EE as a future feature.
help.remnote.comStaff access controls
Access to systems storing user notes is restricted to a small number of employees; staff cannot view notes without explicit user action (temporary Support Access auto-revoked after 60 days, exported copies, or public sharing).
help.remnote.comData monetization
RemNote states it will never sell or monetize user data; revenue comes from subscriptions.
help.remnote.comThird-party subprocessors (non-AI)
DuckDuckGo (favicon lookups, domain names only), CloudConvert (document conversion, files deleted within 24 hours), Wikimedia Commons (concept names only, for image search).
help.remnote.comOffline / local-only mode
Users can keep a knowledge base local-only, preventing any server transmission, at the cost of cross-device sync.
help.remnote.comStatus / uptime transparency
Public status page exists at status.remnote.com (uptime/incident history), though this is an operational signal, not a security certification.
status.remnote.com// Products & data scope
Data it handles: Personal notes, flashcards, limited PDF annotation (3 PDFs), limited AI credits (100/month)
Entry tier; same underlying infrastructure and privacy practices as paid tiers.
Data it handles: Personal + shared knowledge bases, PDF annotation, image occlusion, exam scheduler, handwritten notes, 1,000 AI credits/month
$8/month or $96/year. Pro users can create and share synced knowledge bases with collaborators.
Data it handles: Same as Pro plus lecture recorder, AI grading, AI chat, image-to-text, 20,000 AI credits/month
$18/month or $216/year. No distinct enterprise-grade data controls beyond the AI toggle; a Team/Enterprise plan with SSO or admin controls was not found.
Data it handles: Same product surface as Pro/Pro with AI tiers, discounted for students
Referenced in site navigation ('EDU') but no distinct pricing or data-handling terms were found; treat as a discount program, not a separate compliance tier.
// What to watch
- No trust center, security page, or compliance certifications (SOC 2, ISO 27001, HIPAA, etc.) are found anywhere on RemNote's own domains; this is consistent with RemNote's identity as a small, venture-backed ($2.8M raised) consumer study app.
- The captured Terms of Service page (forum.remnote.io/tos) contains unfilled template placeholder text (e.g., '{{governing_law}} will govern any dispute', '{{city_for_disputes}}') instead of an actual jurisdiction or governing-law clause, suggesting an incomplete or stale legal document.
- RemNote's help-center privacy article promises no AI-model training on note text, but its Terms of Service also grant RemNote a broad 'world-wide, perpetual, royalty-free' license to use, adapt, and publish user content. This is standard hosting boilerplate rather than a training grant.
- Legal entity name is confirmable on a vendor-owned page: the remnote.com homepage footer states '© 2026 RemNote Inc.'; third-party registries (Crunchbase/PitchBook) list RemNote as Delaware-incorporated, headquartered in Wilmington, DE.
- No DPA (Data Processing Agreement) or GDPR-specific compliance page was found; this is a gap for any EU business customer evaluating RemNote.
// At a glance
Pricing model
Freemium subscription: Free, Pro ($8/mo), Pro with AI ($18/mo), plus an EDU student discount. No enterprise/per-seat business plan found.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on RemNote Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
remnote.com