How BinderTastic protects your documents
What the product does today. Shared binders, SSO and Private Sync are planned for Teams and Enterprise.
On your devices
- Data Protection. Binder files on iPad and iPhone are stored with iOS Data Protection, which encrypts them with keys tied to your device passcode.
- Local-first. Your work is saved on the device first, so it is available offline and does not depend on a network connection to be safe.
- Native Apple frameworks. Documents are rendered with Apple’s PDFKit and handwriting is drawn by BinderTastic’s own ink engine on Apple’s Metal — no third-party rendering engines or embedded web views handle your content.
In the cloud
- Google Cloud infrastructure. Sync runs on Google Firebase (Authentication, Cloud Firestore and Cloud Storage) in the United States.
- Encrypted before upload. Files and change records are encrypted on your device (AES-256-GCM) before they are sent. We do not have the keys and cannot read them. Traffic uses TLS, and Google Cloud also encrypts the stored ciphertext at rest.
- Per-user access rules. Server-side security rules restrict each record and file to the account that owns it. Rules are tested automatically before every release.
- Tests never touch the live service. Automated tests run on local emulators, not on production data.
On the website
- Signing in is not enough to open a binder. Your email, Apple or Google account proves who you are. The pages stay locked until an iPad or Mac you already use says this computer is allowed.
- Once per computer. After you say yes, that browser remembers. A new computer, a new browser or a private window needs its own yes.
- We never see the contents. The website unlocks the pages on your computer. We do not have the keys and cannot read them.
Integrity and recovery
- Version history. Saving a document creates a new revision rather than overwriting the old one. Earlier revisions can be restored.
- Both versions are kept. When two devices change the same document, BinderTastic keeps both. It does not drop one of them.
- Tamper-evident audit log. Every change is recorded with the time, account, device and operation. The log is append-only, and each entry carries a hash of the previous one, so alteration or removal of history is detectable.
- Saves are checked. A document is written and verified before the change that points to it is recorded. A crash in the middle of a save cannot leave a binder pointing at a damaged file.
Privacy and AI
- We do not sell your data and we do not use your documents to train AI models.
- AI features are optional, off by default, and can be disabled per binder. Documents are sent to an AI provider only when you turn a feature on.
- Diagnostic logs never contain document content.
On the roadmap for Teams and Enterprise
Private Sync: keep your documents entirely on your own Mac. Your iPad and iPhone sync with it over your office network or VPN, and nothing is stored with BinderTastic or any cloud provider.
Single sign-on (SAML), user provisioning, MDM deployment with managed settings, admin audit views, custom retention, and a data processing agreement. Talk to us about your requirements.
Reporting a vulnerability
If you believe you have found a security issue, please email support@mymetrix.co with the subject “Security report”. We will acknowledge your report promptly and ask that you give us reasonable time to fix the issue before disclosing it.
BinderTastic is in private preview. This page describes the product as built today.