Introduction
Open a note and highlight the text you want to encrypt. Right-click or control-click the highlighted text and select “Encrypt Selected Text.” Enter a password and click OK. To decrypt the text, click on the encrypted text and select ‘Show encrypted text’.
- How secure are Evernote notes? I'm concerned about the security and privacy of my notes, so I was pleased to see this on EN's ' Security Overview:' In late 2016, we began migrating the Evernote service to the Google Cloud Platform (“GCP”).
- Evernote is a feature-rich collaboration and document organization tool used by over 150 million people. It excels at organizing large amount of notes, articles, and files of all types, allowing you to access them from multiple devices and share with team members.
- Evernote uses cookies to enable the Evernote service and to improve your experience with us. To learn more, check out our cookie policy. By clicking OK or continuing to use our site, you agree that we can place these cookies.
- Evernote has advanced options such as optical character recognition (OCR), document scanning and team management features to keep track of every note, each uploaded file and all the deadlines of.
Evernote users trust us with billions of their notes, projects, and ideas. That trust is based upon us keeping that data both private and secure. The information on this page is intended to provide transparency about how we protect that data. We will continue to expand and update this information as we add new security capabilities and make security improvements to our products.
Security Program
Security is a dedicated team within Evernote. Our security team's charter is protecting the data you store in our service. We drive a security program that includes the following focus areas: product security, infrastructure controls (physical and logical), policies, employee awareness, intrusion detection, and assessment activities.
The security team runs an in-house Incident Response (“IR”) program and provides guidance to Evernote employees on how to report suspicious activity. Our IR team has procedures and tools in place to respond to security issues and continues to evaluate new technologies to improve our ability to detect attacks against our infrastructure, service, and employees.
We periodically assess our infrastructure and applications for vulnerabilities and remediate those that could impact the security of customer data. Our security team continually evaluates new tools to increase the coverage and depth of these assessments.
Network Security
Evernote defines its network boundaries using a combination of load balancers, firewalls, and VPNs. We use these to control which services we expose to the Internet and to segment our production network from the rest of our computing infrastructure. We limit who has access to our production infrastructure based on business need and strongly authenticate that access.
Account Security
Evernote never stores your password in plaintext. When we need to securely store your account password to authenticate you, we use PBKDF2 (Password Based Key Derivation Function 2) with a unique salt for each credential. We select the number of hashing iterations in a way that strikes a balance between user experience and password cracking complexity.
While we don’t require you to set a complex password, our password strength meter will encourage you to choose a strong one. We limit failed login attempts on both a per-account and per-IP-address basis to slow down password guessing attacks.
Evernote offers two-step verification (“2SV”), also known as two-factor or multi-factor authentication, for all accounts. Our 2SV mechanism is based on a time-based one-time password algorithm (TOTP). All users can generate codes locally using an application on their mobile device or can choose to have the codes delivered as a text message.
Email Security
Evernote gives you a way to create notes in your account by sending emails to a unique Evernote email address. To protect you from malicious content, we scan all email we receive using a commercial anti-virus scanning engine.
When you receive an email from Evernote, we want you to be confident that it really came from us. We publish an enforcing DMARC policy to improve your confidence that email you receive from Evernote is legitimate. Every email we send from the following domains will be cryptographically signed using DKIM and originate from an IP address we publish in our SPF record.
Evernote:
- @evernote.com
- @emails.evernote.com
- @comms.evernote.com
- @discussion-notification.evernote.com
- @mail-svc.evernote.com
- @account.evernote.com
- @notifications.evernote.com
- @messages.evernote.com
Product Security
Securing our Internet-facing web service is critically important to protecting your data. Our security team drives an application security program to improve code security hygiene and periodically assess our service for common application security issues including: CSRF, injection attacks (XSS, SQLi), session management, URL redirection, and clickjacking.
Our web service authenticates all third party client applications using OAuth. OAuth provides a seamless way for you to connect a third party application to your account without needing to give the application your login credentials. Once you authenticate to Evernote successfully, we return an authentication token to the client to authenticate your access from that point forward. This eliminates the need for a third party application to ever store your username and password on your device.
Every client application that talks to our service uses a well-defined thrift API for all actions. By brokering all communications through this API, we’re able to establish authorization checks as a foundational construct in the application architecture. There is no direct object access within the service and each client’s authentication token is checked upon each access to the service to ensure the client is authenticated and authorized to access a particular note or notebook. Please see dev.evernote.com for more information.
Customer Segregation
The Evernote service is multi-tenant and does not segment your data from other users’ data. Your data may live on the same servers as another user’s data. We consider your data private and do not permit another user to access it unless you explicitly share it.
Data Retention and Deletion
Evernote retains your content unless you take explicit steps to delete notes and/or notebooks. For information on how to delete notes, please see this help center article. For information on our retention policies, please refer to the section of our privacy policy, titled “Information Deletion”.
Media Disposal and Destruction
We securely erase or destroy all storage media if it has ever been used to store user data. We follow NIST’s guidance in special publication 800-88 to accomplish this. For an example of how we securely destroy broken hard drives, please check out this blog article.
We utilize a variety of storage options in Google’s Cloud Platform (“GCP”), including local disks, persistent disks, and Google Cloud Storage buckets. We take advantage of Google’s cryptographic erasure processes to ensure that repurposing storage does not result in exposing private customer data.
Activity Logging
The Evernote service performs server-side logging of client interactions with our services. This includes web server access logging, as well as activity logging for actions taken through our API. We also collect event data from our client applications. You can view the recent access times and IP addresses for each application connected to your account in the Access History section of your Account Settings.
Transport Encryption
Evernote uses industry standard encryption to protect your data in transit. This is commonly referred to as transport layer security (“TLS”) or secure socket layer (“SSL”) technology. In addition, we support HTTP Strict Transport Security (“HSTS”) for the Evernote service (www.evernote.com). We support a mix of cipher suites and TLS protocols to provide a balance of strong encryption for browsers and clients that support it and backward compatibility for legacy clients that need it. We plan to continue improving our transport security posture to support our commitment to protecting your data.
We support STARTTLS for both inbound and outbound email. If your mail service provider supports TLS, your email will be encrypted in transit, both to and from the Evernote service.
We protect all customer data flowing between our data center and the Google Cloud Platform using IPSEC with GCM-AES-128 encryption or TLS.
Encryption at Rest
In late 2016, we began migrating the Evernote service to the Google Cloud Platform (“GCP”). Customer data that we store in GCP will be protected using Google’s built-in encryption-at-rest features. More technically, we use Google's server-side encryption feature with Google-managed encryption keys to encrypt all data at rest using AES-256, transparently and automatically. You can find additional information on how encryption at rest protects your data here.
Resiliency / Availability
We operate a fault tolerant architecture to ensure that Evernote is there when you need it.
In our both our physical data centers and our cloud infrastructure, this includes:
- Diverse and redundant Internet connections
- Redundant network infrastructure including switches, routers, and firewalls
- Redundant application load balancers
- Redundant servers and virtual instances
- Redundant underlying storage
Both Google and our colocation vendor provide fault tolerant facility services including: power, HVAC, and fire suppression.
We provide live and historical status updates on our service availability here: https://twitter.com/evernotestatus and http://status.evernote.com.
We back up all customer content at least once daily. We do not utilize portable or removable media for backups.
Physical Security
We operate the Evernote service using a combination of cloud services and physical data centers.
For our data centers, we secure our infrastructure in a private, locked cage that includes 24x7x365 monitoring. Access to these data centers requires at a minimum, two-factors of authentication, but may include biometrics as a third factor. Each of our data centers has undergone a SOC-1 Type 2 audit, attesting to their ability to physically secure our infrastructure. Only Evernote operations personnel and data center staff have physical access to this infrastructure and our operations team is alerted each time someone accesses our cage, including a video record of the event.
For our cloud services, we use the Google Cloud Platform. Google has undergone multiple certifications that attest to its ability to physically secure Evernote’s data. You can read more about Google Cloud Platform’s security here.
All Evernote data resides inside the United States.
Privacy and Compliance
Please see our privacy center for more information. We do not publish a Service Organization Control (“SOC”) report.
With Evernote’s change in pricing, lots of people want to switch to a different service. I’m happy with Evernote, but I still realize I need to back it up regularly. Sure, it’s in the cloud, but if the price gets too high, I’d consider switching. It’s my data and I’m ultimately responsible for it. I won’t allow it to be kept hostage by anyone. Here’s how to keep your options open and data safe, especially if your account gets hacked.
Manually Exporting Evernote Data
We covered how to do a manual backup when talking about switching to OneNote or Google Keep. To review, from the Mac or PC, go to the File menu and select Export. Then you’ll get a choice of formats. If you want to be able to restore it within Evernote, pick .enex.
Want more out of Evernote?Check out our Complete Guide.If you just want the information to access it later html gives you more flexibility. If you’re going through the trouble of a manual backup, you might as well use both methods. The Windows versions gives you the option to export a notebook to .pdf. Sadly, as of this writing, the Mac doesn’t support .pdf export. You can print individual notes to .pdf, but that’s a pain for a large notebook.
Evernote Database Backup
You can make Evernote part of your regular automated backup strategy. If you’re using Apple’s Time Machine or other cloning software, the data’s already there. For online backups or other methods, make sure you’re backing up the Evernote folder on your computer. Currently, they’re located at:
Mac: ~/Library/Application Support/Evernote or ~/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/
PC: C:Users[PC Name]AppDataLocalEvernoteEvernoteDatabases
Your location could be different, but those are the defaults.
In a disaster, you’ll need to install Evernote and then restore your database. There are some other cool ways using cloud-based services.
Do you test your backups? You probably should. Here’s how to do it on a Mac.Zap it with Zapier
If you’re using the free version of Evernote, you’re limited in the number of devices you can install the Evernote app. If you’re keeping your stuff in the web, the backup methods above won’t work. The web version doesn’t give you an export option. That’s where Zapier comes in.
We’ve covered Zapier’s competitor IFTTT before. Zapier has a ton more integrations and options, but you’ll pay for them if you need more than 100 actions each month. Each new note backed up is an action. The next level plan is 1,000 actions for $20, so it’s still pretty reasonable if you’re a regular Evernote user.
New to IFTTT? Here are some fun ideas to start with. After that, check out ideas for Pocket, locations, photos.Once you connect your Evernote to your IFTTT account, you can put those notes wherever you want. Zapier already has a ready-to-go Zap for backing up new notes from Evernote to Dropbox. You can use any system you want like Box or OneDrive.
The big disadvantage with this option is it only backs up up new notes. If you’ve done a manual backup and just need new notes backed up going forward, this is a cheap and easy approach.
Evernote Onenote
Back it All Up with CloudHQ
CloudHQ takes things from one cloud service and syncs it with another. If you’re using the free version of Evernote, CloudHQ lets you backup your Evernote to another cloud service for free. They’ll let you use storage space on Amazon, Box, Dropbox, Google, or One Drive at no charge. If you’re using the paid version of these services, though, you’ll pay $9.90/month to back them up.
CloudHQ is handy for free Evernote users who don’t want to move to Premium. It lets you access your content automatically through another service. You can keep your notes in Evernote, but access PDFs of them in Google Drive.
Evernote Secure Notes Login
Go Cheap: Combine them All
If you’re looking for a one-time backup of your data before your downgrade, export the files and then backup the databases. Then moving forward, use Zapier to backup the notes. If you use it more than Zapier’s free service, then it’s time to upgrade Zapier or move onto another service. If you pay for Zapier, you’ll get to use it for other things like backing up your Google info.
If you’ve already moved to web-only for Evernote, CloudHQ lets you pay month-to-month if you don’t qualify for the free version. Let them back up your existing database from Evernote into another service. Then cancel the service and use Zapier to back up your new notes.
Keep Your Evernote Options Open
Whichever option you choose, don’t rely on Evernote to keep all your data. If your account gets hacked or your lock yourself out with two-factor authentication, you’ll need the data somewhere else. If Evernote raises its prices again, you’ll be able to walk away easily without your data being trapped in their system.
ALSO READ:How To Search In Evernote Like A Pro
The above article may contain affiliate links which help support Guiding Tech. However, it does not affect our editorial integrity. The content remains unbiased and authentic.
Read Next
Evernote Notes Not Showing Up
Top 10 Apps, Plugins and Tricks To Save Anything In Evernote
Export All Evernote Notes
Here are the Top 10 Apps, Plugins and Tricks To Save Anything In