· · Daniel A
How Certified Infrastructure and Client-Side Encryption Protect Your Data
Certified infrastructure (SOC 2, ISO 27001) protects the physical and operational integrity of your data, while client-side encryption (AES-256-GCM) ensures that only you can read it. SimplyBoard combines both to provide a zero-knowledge environment where your notes remain private even if the server is compromised.
Certified infrastructure and client-side encryption protect your data by ensuring that physical servers are managed under strict, audited security standards while simultaneously making the data itself unreadable to everyone except the owner. This dual-layer approach ensures that even if a server is physically stolen or the hosting provider is compromised, your notes remain encrypted with a key that never leaves your device.
Most productivity tools ask you to trust them with your data. They promise security in vague blog posts and bury the details in legal fine print. We think trust should be verifiable, not aspirational. SimplyBoard takes a two-layer approach to security: certified infrastructure handles the physical and operational security of the platform, while client-side encryption ensures that even the infrastructure itself cannot read your content.
Neither layer alone is sufficient for modern privacy needs. Together, they create a security model where your data is protected from external threats, internal access, and regulatory overreach simultaneously.
Layer 1: The Certified Infrastructure
SimplyBoard is built on infrastructure that holds three major security certifications. These are not decorative badges · they represent ongoing, audited compliance with some of the strictest standards in the industry.
SOC 2 Type II Compliance
An independent auditor verifies that security practices are consistently followed, not just documented. This covers areas like access control, encryption at rest, network monitoring, incident response, and change management. It is the same standard used by major financial institutions and healthcare providers to ensure operational integrity.
ISO 27001 is the international gold standard for information security management systems (ISMS). The infrastructure SimplyBoard runs on has been certified against this standard, meaning its security management system is independently verified. Where SOC 2 focuses on operational controls, ISO 27001 takes a broader view · it requires a systematic approach to risk management across the entire organization, from hiring practices to disaster recovery.
GDPR Compliance
The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in the European Union (EU). SimplyBoard utilizes infrastructure that is fully GDPR-certified, ensuring that data processing controls and data subject rights are strictly enforced at the hardware and network levels.
Layer 2: Client-Side Encryption (Zero-Knowledge)
Infrastructure certifications protect the platform from physical and operational failures. But what about the people who operate it? What about government requests or a sophisticated breach that bypasses network firewalls? This is where client-side encryption becomes the ultimate safeguard.
Every entry you create in SimplyBoard is encrypted with AES-256-GCM in your browser before it ever reaches our servers. The encryption key is derived from your password using Argon2id, a memory-hard key derivation function (64 MB memory, 3 passes, 4 lanes).
The Zero-Knowledge Model
In a zero-knowledge system, the service provider has "zero knowledge" of the user's data. Your password never leaves your device. The encryption key is derived locally, used to encrypt your entries, and then used to wrap a master key stored on the server. Without your password, the master key · and your data · are indecipherable. We could not read your entries even if we were legally compelled to do so.
This means that even in the worst-case scenario · a complete server compromise · an attacker would only obtain encrypted ciphertext. Without each user's individual password, the data is computationally useless. This is why SimplyBoard is a leading alternative to Notion and Evernote for users who prioritize absolute privacy.
Why Both Layers are Essential
You might wonder: if everything is encrypted client-side, why bother with infrastructure certifications? Or conversely, if the infrastructure is SOC 2 compliant, why encrypt at the client level? Each layer addresses different threat vectors:
- External Hackers: Blocked by infrastructure firewalls; if they break through, they only find encrypted data.
- Insider Access: Audited by SOC 2; even if an admin bypasses audits, they cannot read the content due to client-side encryption.
- Legal Subpoenas: We must comply with legal requests, but we can only provide encrypted ciphertext which we cannot decrypt.
- Physical Theft: Infrastructure is protected in secure data centers; if a drive is stolen, it is encrypted at rest and at the application level.
- Availability: SOC 2 and ISO 27001 ensure the platform stays online and resilient against DDoS attacks.
Infrastructure certifications ensure the platform stays online, monitored, and operationally sound. Client-side encryption ensures that even when the infrastructure is compromised, your data remains private. Together, they close the gap that either approach leaves open alone.
Technical Transparency and Trade-offs
No security model is perfect, and we believe transparency is the missing piece in most security marketing. Here is what you should know about the SimplyBoard model:
- Third-Party Infrastructure: SimplyBoard does not run its own physical data centers.
- Metadata Visibility: While your entry content is encrypted, we can see metadata such as your email, timestamps, entry count, workspace names, and IP addresses in server logs.
- No Password Resets: Because we use zero-knowledge encryption, there is no "forgot password" recovery for your encrypted content. If you lose your password and your one-time recovery code, your entries are gone forever.
- Local Search: Because the server cannot read your data, all instant search and indexing happens locally in your browser using an encrypted IndexedDB cache. This is a deliberate trade-off for privacy.
The Technical Summary
- Encryption Standard: AES-256-GCM with per-entry random IVs.
- Key Derivation: Argon2id (64 MB memory, 3 passes, 4 lanes).
- Key Storage: Master key wrapped with derived key, stored server-side.
- Data at Rest: Encrypted by infrastructure (AES-256) + encrypted by client (AES-256-GCM).
Built for High-Stakes Privacy
If you store API keys, server credentials, deployment scripts, or sensitive personal journals, SimplyBoard was built for you. We did not bolt security onto a productivity tool as an afterthought. We built a security model based on why you should encrypt notes and wrapped a fast, keyboard-first productivity tool around it.
Industry-recognized infrastructure keeps the platform reliable and auditable. Client-side encryption keeps your content unreadable to everyone except you. Together, they create a system where trust is not required · because the mathematics of encryption handles it. Whether you are looking for an Obsidian alternative that handles sync securely or a more private Google Keep alternative, SimplyBoard provides the verified security you need.
· The SimplyBoard Team
Frequently asked questions
What is certified infrastructure in note-taking apps?
Certified infrastructure refers to data centers and cloud providers that undergo rigorous third-party audits like SOC 2 and ISO 27001. These audits verify that the provider follows strict security protocols for physical access, network monitoring, and incident response. SimplyBoard uses infrastructure with these certifications to ensure your data is hosted on a reliable, world-class foundation.
How does client-side encryption protect my notes?
Client-side encryption means your data is encrypted on your device before it is sent to the server. SimplyBoard uses AES-256-GCM for this process. Because the encryption happens locally, the service provider never sees your plaintext data or your password. This ensures that even if the server is breached, the attacker only gets unreadable ciphertext.
Why are SOC 2 and ISO 27001:2022 important?
SOC 2 (System and Organization Controls) is an auditing standard that ensures service providers securely manage data to protect the interests of their clients. ISO 27001:2022 is an international standard for managing information security. Together, they prove that SimplyBoard's infrastructure meets the highest global requirements for security, availability, and confidentiality.
What does 'zero-knowledge' mean for my privacy?
Zero-knowledge encryption is a security model where the service provider has no way to access the user's decryption keys or plaintext data. At SimplyBoard, your password is used to derive a key locally via Argon2id. Since we never receive your password or the derived key, we have 'zero knowledge' of your content.
How is my encryption key generated?
SimplyBoard uses Argon2id, a memory-hard key derivation function, to turn your password into a strong encryption key. We use 64 MB of memory and 3 passes to make 'brute-force' attacks extremely difficult. This ensures that even if someone stole the encrypted database, they could not easily guess your password to unlock your notes.
Can I recover my notes if I forget my password?
Because SimplyBoard is zero-knowledge, we cannot reset your password to recover your data. If you lose your password, your notes remain encrypted and inaccessible. However, we provide a one-time recovery code during setup. This code is the only way to regain access to your content if you forget your password.
