How BeornNotes protects your records
You are putting other people's lives in here: clients, cases, the people your program works with. You are entitled to know how it is looked after, in plain terms, without a page of badges.
This page says what is true. It also says what is not true, which is the part most vendors leave out.
Getting in
Passwords are never stored. What we keep is a one-way hash (PBKDF2), so even we cannot read your password — and a stolen database does not hand anyone your users' passwords.
Known-breached passwords are refused. When someone sets a password it is checked against a public database of passwords already exposed in breaches elsewhere, without the password ever leaving our server in readable form. If it has appeared in a breach, they are asked to choose another.
Two-factor authentication can be required for everyone in your account.
Sessions time out. You set how long, so a machine left unlocked in a busy office does not stay signed in all afternoon.
Who sees what
Access is set per person, not per company:
- Full, read-only, or restricted to only the records they own. Read-only is enforced on the server, not merely hidden in the interface — which is how volunteers and part-time staff can use the same system without seeing everyone.
- Individual fields can be hidden or made read-only, so two people can work from the same record without the same view.
- Records lock while someone has them open, so two people cannot quietly overwrite each other.
What happened, and who did it
Every change is kept: the field, the previous value, the new one, who made it, and when — with a separate trail for every document.
Notes can be corrected but never deleted, and an edit is marked as an edit. A record of what happened that can be quietly rewritten is not a record, and for work that is reviewed, funded or occasionally challenged, that difference is the whole point. See the audit trail.
In transit, at rest, and in the backups
Everything between your browser and BeornNotes is encrypted with current TLS.
The database itself is encrypted at rest, with AES-256, on the server's own disks. Lift the database files off that machine and they are unreadable — not merely access-controlled, but encrypted, so a disk that is stolen, resold or retired by a hosting company carries nothing anyone can open.
Every backup is encrypted with AES-256 before it leaves the server, and held off-site in more than one place.
And the backups are tested by actually restoring them. A backup nobody has restored is a guess — ours are taken off-site, decrypted on a different machine, and restored into a working database to prove they come back. It is an ordinary thing to do and a surprisingly rare one.
Uploaded documents are held in private storage that is not publicly reachable, with their own access controls.
What we do not claim
This is the section to read closely.
BeornNotes is not HIPAA compliant, and we do not sign business associate agreements. If your work involves protected health information, we are not the right system and we would rather tell you now than take your money and disappoint you in month three. Non-clinical confidentiality — attorney-client privilege, ordinary casework, safeguarding records — is a different matter and perfectly well served.
We hold no SOC 2 report and no ISO certification. Plenty of software your size says "enterprise-grade security" and means nothing by it. We would rather describe the actual controls above and let you judge.
We are a small company. "We" is how we write, not a claim about headcount. There is no large security department here and we will not pretend otherwise — though the servers themselves sit in a professionally run datacenter with its own round-the-clock security and operations staff.
Your data stays yours
You can export from any grid at any time. If you leave, you take your records with you — there is no hostage-taking and no export fee. When an account is closed, its data is removed.
If you find a problem
Tell us: Support@BeornNotes.com. Support is handled by our own people in the US — not AI agents, and not an outsourced help desk. Whoever answers knows the product. A security report therefore reaches someone who can act on it, not a ticket queue.
We will not threaten anyone who reports a genuine problem in good faith.
Still deciding? The buyer's guide has the questions worth asking any vendor, including this one.