Data & Security

Notēsis is designed so project content is available only to people who are authorized to access that project. Research notes, memos, meetings, transcripts, literature records, and project files are protected by project-level access controls rather than being publicly accessible.

Project files are stored in private Supabase Storage. Database Row Level Security (RLS) is used throughout the application to enforce which projects and records a signed-in user may access.

Project owners control collaboration. A collaborator can access a project only after being added as a project member or successfully accepting a valid invitation.

Collaborators do not automatically receive owner-level permissions. Project ownership and project membership remain separate.

Pending invitations do not grant project access until the invitation is successfully claimed by the intended account.

1. 1Notēsis checks whether the file type is permitted.
2. 2Notēsis checks the project's available storage.
3. 3The upload is screened for malware before it is treated as a trusted project file.
4. 4The file is stored in private project storage.
5. 5Notēsis records project and uploader information so access and storage usage can be managed correctly.

Video uploads and dangerous executable or active-content file types are currently blocked.

Permitted uploads are screened with ClamAV before they are treated as trusted files. In production, Notēsis is configured to fail safely if malware scanning is unavailable rather than silently accepting an unscanned file.

Malware definitions are initialized and refreshed automatically as part of the production deployment and scanning process.

No malware scanner can guarantee detection of every malicious file.

Notēsis uses AI only for specific, user-initiated features. AI is intended to support researcher workflow and reflexivity—not replace the researcher as the analyst.

Examples of permitted AI assistance include transcription, reflective prompt suggestions, non-leading follow-up questions, and narrowly defined administrative Meeting synthesis.

Meeting administrative synthesis may organize topics discussed, explicit decisions, action items, unresolved questions, and logistical next steps. It is not permitted to generate research findings, code data, infer themes as findings, recommend analyses, propose research questions, or decide what evidence means.

Notēsis should send only the information needed for the feature the researcher explicitly requests. Literature Review annotations are excluded from AI context.

Notēsis is designed to preserve the history of researcher-controlled records rather than silently replacing them.

• The original machine-generated transcript remains distinct from researcher corrections.
• Transcript correction history is retained.
• Re-running Meeting administrative synthesis preserves prior versions.
• Audio recordings are not automatically deleted after transcription.
• Storage reconciliation reports inconsistencies rather than automatically deleting ambiguous files.

This helps preserve a clear record of what was generated, what was changed, and what remains researcher-authored.

• Storage consistency is checked on a scheduled basis.
• Storage reconciliation is report-only.
• Ambiguous files are not automatically deleted.

If you are evaluating Notēsis for research involving sensitive or institutionally governed data, review your institution's requirements before uploading that material.