Security

Your work stays on your Mac
until you send it.

How North Star protects what you capture, record and share, who handles it on our side, and what isn't in place yet. For each kind of data and where it goes, see Privacy.

On your Mac by default

Recording, transcription, screenshots, annotation and OCR run on your Mac. Something you made leaves it only when you share it, or when you turn on backup with Pro.

Redaction that can't be undone

Redaction is opaque tape burned into the pixels before the file is written. There is no blur for anyone to reverse.

Your voice stays on your Mac

Dictation audio is never uploaded. The app has no code that could upload it, and an automated test fails if any appears.

Share links

  • A link's address holds a random 22 character id, about 131 bits. It can't be guessed, and share pages are never listed or indexed by search engines.
  • Anyone with the link can open it, so share what you mean to share.
  • You can revoke a link from the app at any time. Its page stops opening at once, and the file is deleted from our storage.
  • Links on the free plan are deleted after 30 days. Pro links last until you revoke them.
  • Anyone can report a link from its page. A report is reviewed, and a link that breaks our terms is taken down.

Your account and our servers

  • You sign in with a code we email you, or with Google. North Star never sees or stores a password.
  • Row-level security in the database checks that every row you read or write is yours.
  • The app reaches our servers with your own sign-in. The keys that could read everyone's data are held only by our API, never inside the app.
  • In a company account, an admin can switch any cloud feature off for everyone in it, and our servers enforce the switch.
  • Our admin tools hold no master key. Anything that removes or takes away needs a fresh two-factor check, and every action is logged.
  • Everything between the app, this website and our servers travels over HTTPS.

The Mac app

  • Signed with our Apple Developer ID and notarized by Apple.
  • Before installing an update, the app checks its signature and our team id, and refuses one that doesn't match.
  • No AI or service keys are built into the app. AI requests, when you turn cloud AI on, go through our API, which holds the key.
  • Usage analytics and crash reports carry no content from your work, and each can be turned off in Settings.

Who handles what

The companies we rely on

Supabase
Our database, file storage and sign-in. Stored data is encrypted at rest.
Vercel
Hosts this website and our API.
Google
Sign-in with your Google account.
Paddle
Takes payment for Pro as merchant of record. We never see your card details.
Resend
Sends the emails we send: invites, welcome emails and replies to the contact form.
GitHub
Stores app releases. Your Mac downloads updates through our API.
Anthropic
Runs Claude for cloud AI, only if you turn it on. Cloud AI isn't offered today.
LangSmith
Traces AI agent runs, only with cloud AI on. Not used today.

What isn't in place yet

  • A SOC 2 report or another third-party audit.
  • Single sign-on other than Google, such as SAML, Okta or Microsoft.
  • Share links with a password, or open only to your team.
  • A log for company admins of who shared what.

Each one moves off this list when it ships.

Report a vulnerability

If you find a security problem in North Star, the website or a share link, tell us through the contact form with the topic set to Security report. Say what you found and how to reproduce it. We reply to every report.

While you look, please don't access or change other people's data, don't disrupt the service, and give us a reasonable time to fix a problem before you make it public.

Send a security report

Last reviewed 31 October 2026. Also at /.well-known/security.txt.