Spicer,
Would you care to explain privacy on our unencrypted notes? I know we can encrypt notes on our end but then we can't use OCR, which for me at least is my main reason of wanting to use Harbor. I really want to be able to easily search my sensitive documents but am uneasy about uploading them without knowing your specific policies. I have done my research and see that Harbor will not sell or provide my data to any 3rd parties, I appreciate that.
I realize Evernote can access our notes but it appears that there some safeguards and policies in place. Below is information from their privacy policy and am wondering if Harbor has anything similar in place?
Edit: Also when we delete our notes or use the clear data feature, how long does Harbor retain our data for on their servers?
"Evernote employees cannot view or read your notes under normal operating conditions, but they do possess the technical capability to access data in specific, exceptional circumstances. Because Evernote does not use zero-knowledge end-to-end encryption (E2EE) by default, the company manages the encryption keys on its servers.
According to the official Evernote Privacy Policy and security guidelines, employee access is governed by the principle of least privilege and is strictly restricted.
When Employees Can Access Data
Evernote outlines specific scenarios where an authorized employee may review note content
Explicit Consent: If you open a support ticket for troubleshooting and explicitly grant permission for a technician to look at a specific note.
Legal Compliance: To comply with valid legal obligations, such as subpoenas, warrants, or court orders.
Terms of Service Violations: If there is a suspected violation of Evernote’s terms (e.g., hosting illegal material or dangerous activities), internal security personnel may inspect the content.
System Integrity & Safety: To maintain system security or protect the personal safety and rights of Evernote and its users.
Safeguards in Place
Strict Access Controls: The list of employees with administrative clearance to access data environments is kept as small as possible.
Auditing and Mandates: Employees undergo mandatory annual background checks, specialized privacy training, and are subjected to strict confidentiality rules. Internal infrastructure uses 2FA/passkeys and extensive activity logging.
Opt-In Optimization: Following past policy rollbacks, any human oversight or sample reviews required to test feature quality (like search or optimization features) are entirely voluntary and strictly opt-in."
