// Trust & Security Report
Roam Research
Roam Research - a graph-based note-taking / knowledge-management tool ('a note-taking tool for networked thought'), with a web app, desktop apps (macOS, Windows, Linux), mobile apps (iOS, Android), and a Chrome extension ('Roam Reader'). Single core product with Pro (subscription) and Believer (lifetime) plans; no separate enterprise or API-only SKU observed.
Certifications held
0
Maturity
Startup
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: roamresearch.comNo public evidence. No trust center, SOC 2 badge, or audit report found on roamresearch.com. A third-party aggregator (Nudge Security) lists Roam Research as 'SOC 2 Compliant,' but this is not corroborated by any vendor-domain source.
source: roamresearch.comNo public evidence on roamresearch.com. The same unverifiable third-party claim noted for SOC 2 applies here as well.
source: roamresearch.comNo public evidence of GDPR-specific representative or DPA language was confirmed on the vendor's own domain, and this could not be distinguished from claims belonging to a similarly named 'Roam' company.
source: roamresearch.comNo public evidence. No BAA, healthcare-specific terms, or HIPAA statement found for this note-taking product.
source: roamresearch.comNo public evidence. Payment processing appears to be delegated to a third-party processor (Stripe, per third-party supply-chain listing); no vendor-domain PCI statement found.
source: roamresearch.comNo public evidence. No AI governance certification or AI-specific trust page found.
source: roamresearch.comNo public evidence on the vendor's own domain; only an unverified third-party aggregator claim exists.
source: roamresearch.comNo public evidence; not applicable/expected for a company of this size and product type.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
not verified
No public AI-training policy found for Roam Research's own product. The homepage advertises a 'Roam Reader for Chrome' extension but provides no data-usage/training disclosure. No opt-out mechanism or tiered AI-training language was located. Not verified.
// Security controls
Vulnerability disclosure
Roam Research's official GitHub organization (github.com/Roam-Research) publishes a security policy: reports go to security@roamresearch.com, a coordinated-disclosure model with a default 90-day remediation window, and a safe-harbor clause for good-faith researchers.
github.com// Products & data scope
Data it handles: User-authored notes, graphs, and uploaded files/attachments; account and billing information
Core product across Pro ($15/mo or $165/yr) and Believer ($500 one-time for 5 years) plans; both include unlimited private/public graphs, unlimited collaborators, and API access.
Data it handles: Browsing content the user chooses to clip into Roam
Newly promoted on the homepage ('NEW: Try Roam Reader for Chrome'); no separate security/privacy documentation found for it.
// What to watch
- A third-party aggregator (Nudge Security) lists Roam Research as SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, and CSA STAR compliant. This is not corroborated by any vendor-domain evidence and is implausible for a company of this size.
- Several unrelated companies also brand themselves 'Roam,' including ro.am / 'Roam Virtual Workspace' (a virtual office/video platform with its own GDPR/EDPO/encryption documentation, not this vendor), Roam Network, Roam.ai, Roam Resource, Roamr, and roam.plus. None of their certifications or privacy terms belong to Roam Research (roamresearch.com).
- The company appears to be a small, resource-constrained startup (~10 employees per third-party company-profile sites; ~$9M raised) with reportedly slow product velocity (per Every.to, 'The Fall of Roam', 2026), consistent with having no formal third-party compliance program.
// At a glance
Pricing model
Subscription (Pro: $15/mo or $165/yr) plus a one-time lifetime tier (Believer: $500 for 5 years)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Roam Research, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
roamresearch.com