Security

Security is job #1. Mikipage exists so you can write down the things you haven't shown anyone yet — so keeping them safe is not one feature among many, it is the job. We will never trade it for convenience, growth, or a deadline. When protecting your data and shipping something faster pull in different directions, protecting your data wins.

This page says what that means in practice, specifically rather than reassuringly.

Where your data lives

On AWS. Mikipage runs on Amazon Web Services in the US (us-east-1): the app, the database that holds your notes and pages, and the storage for your attachments. The search index that powers meaning-based search runs on Qdrant Cloud, hosted in the same AWS region.
Encrypted in transit. Every connection — your browser to Mikipage, the API, and our servers to each other and to the search index — goes over HTTPS (TLS). Nothing travels in the clear.
Encrypted at rest. Your notes, pages and account data (in Amazon DynamoDB) and your attachments (in Amazon S3) are stored encrypted on disk.

Who can read your notes

Your Personal notes are yours. No other user can see them.
A note you share to a group is readable by that group's members. They can't edit it.
Nothing is public unless you make it so — by putting it in a group and deliberately making that group public. See [1].
AI reads your notes when it runs. Building pages, AI Polish and chat send note text to the AI model providers that do the work. That is how the AI features work at all, and it is exactly what a protected note opts out of.

Encryption at rest protects your data from someone who gets hold of a disk. It does not stop Mikipage's own servers from reading your notes — they have to, to search and organize them. For the handful of things you want nobody but yourself to be able to read, use a protected note.

Protected notes

A protected note is encrypted in your browser, with a password you choose, before it is saved. The password never leaves your browser and is never stored anywhere — not on our servers, not in your browser's storage. What reaches Mikipage is ciphertext: a block of scrambled text that nobody at Mikipage, and nothing in Mikipage, can turn back into your words.

That makes it a note the product deliberately cannot help with — no search inside it, no AI, no version history. Keep it for the things that are worth that trade.

Protecting a note

Open the note, and choose Protect from its ⋮ menu. Pick a password (at least 4 characters) and type it twice.

The note's text moves into the encrypted part, and the note's visible text is replaced with a short description — "Protected note. Add a description here." — which you can edit. The note stays unlocked, so you can carry on.

You don't have to save first. On a new note, Protect is there as soon as you start typing, and whatever is in the editor — saved or not — is what gets encrypted. Protecting before the first save means the text never reaches our servers as anything but ciphertext.

Protecting cannot be undone. A protected note stays protected. If you ever want an ordinary note back, unlock it, copy the text into a new note, and delete the protected one.

Locked and unlocked

A protected note is either Locked or Unlocked; the badge on the left of the note's action bar shows which, and clicking it switches.

Locked, you see the description and the encrypted text exactly as it is stored — the same block of letters and numbers our servers hold. It can't be edited.
Unlocked, you see the text, and Edit opens two fields: the description and the protected text. Save writes both.

Unlocking lasts only while the note stays open in that tab. Moving to another note, reloading the page or closing the browser locks it again. The unlocked text lives in the page's memory only — it is never written to your browser's storage, and there is no draft recovery for it, so save before you leave. Locking a note you are editing saves your changes first.

The description

The description is not encrypted. It is what you see in your notes list and in search, what tells one protected note from another, and what AI can read like any other note. Write something that reminds you what's inside — "bank logins", "safe combination" — without giving the secret away.

Attachments

Attachments are not encrypted, so on the website a protected note can't have any: there is no attach or insert-picture option while editing one, and a note that already has attachments must have them removed before it can be protected. The API can still attach files to a protected note — those files are stored like any other attachment, unencrypted. For a sensitive file, encrypt it yourself before uploading it anywhere.

You can share a protected note to a group. Members see the description and the encrypted text, and can unlock it only if you give them the password — which you do outside Mikipage.

If you forget the password

The protected text is gone. There is no reset and no recovery, by you or by us — a reset would mean we held the key, and the whole point is that we don't. Choose a password you will remember, or keep it in a password manager.

What happens to the note's history

Protected notes keep no version history, and protecting a note deletes the history it already had, so earlier copies of the text don't linger. The note's AI-generated title and summary are cleared too.

Protecting a note can't reach back into things that were made from it before you protected it: a page already built from it, a chat or AI run log that quoted it, a comment, or a notification email. Those keep what they said until they are refreshed, edited or deleted. If the note was published with a public web address, that address may contain words from its first line; you can change it in the note's details. For something truly sensitive, protect the note before sharing it or building pages from it.

Under the hood

For the technically curious: the key is derived from your password with PBKDF2-SHA256 (600,000 iterations) and a random salt, and the text is encrypted with AES-256-GCM, using the Web Crypto API built into your browser. The stored value is a Base64 string holding a version byte, the salt, a fresh random IV for every save, and the ciphertext with its authentication tag. The API documents the same format, so a program holding the password can decrypt a protected note without us.