OXU Guard Integration Disclosure

1. What this is

OXU Guard is OXU's internal security monitoring service. It is built to the same security bar as the rest of OXU's products, exists solely to protect your organization, and is not a separate company or third party — it is operated by us, under the same security and confidentiality commitments as OXU Note itself. When your organization enables it, OXU Note sends a record of security-relevant activity to OXU Guard so it can spot suspicious behavior and raise alerts.

The short version: What's shared is limited, non-identifying activity metadata — action type, timestamp, success/failure — never your note content, keys, PINs, or Stealth Mode data. OXU Guard never passes this data to any outside third party, never sells it, and never uses it for advertising. It exists for one purpose: detecting security risk to OXU Note and your organization, and alerting your security team.

This page explains exactly what OXU Note shares with OXU Guard, and what it never shares.

2. When data is shared

Data is shared only after your Organization Admin turns on Data Sharing for OXU Note (in the Admin Console, under Settings → Security → OXU Guard). While it is off, OXU Note sends nothing to Guard. Your admin can:

Pause — stop sending new data (existing data is kept), or
Turn Off — stop sending and permanently delete all previously shared data.

3. What OXU Note shares

When enabled, OXU Note shares activity metadata only — a record of who did what, when, and from where. This is low-sensitivity, operational data: it doesn't tell OXU Guard (or anyone) what's inside your notes or notebooks, and by itself it has no effect on your account, your data, or how you use the app — it is purely a record for detecting suspicious patterns. It covers these activities:

Activity	What's shared (metadata)
Sign-in & session	Sign-in attempts, session token refresh, and sign-out events (via OXU IDP) — the action type and whether it succeeded or failed.
Account recovery & device setup	A new device was added to your account, a Recovery Key import was started or completed, or a one-time device-transfer QR was generated or scanned — the action type and status only. The Recovery Key itself, the QR payload, your PIN, and any Stealth recovery key are never included.
Notebook & note sync activity	An encrypted note or notebook was created, updated, deleted, or restored from Trash on OXU Cloud — an internal note/notebook reference ID (opaque) and the action type. Never the note's title, content, notebook name, or audio.
Device management	A device was registered to your account or signed out — an internal device reference ID and the action type.
Workspace & account activity	A workspace switch, or a membership change made by your Oten administrator (via OXU IDP) — the action type and status only.

Records may also include, where available: the acting user (ID and email), source IP address and device, a timestamp, and whether the action succeeded or failed.

OXU Note never shares with OXU Guard:

The content, title, or notebook name of any note, or any audio recording. Everything is encrypted on your device before it ever reaches our servers — we cannot read it, so we cannot send it.
Any encryption or recovery material — including your encryption keys, your Recovery Key, your app PIN, your per-note lock PINs, and your Stealth Mode PINs.
Anything about Stealth Mode or hidden spaces — whether you have activated Stealth Mode, how many hidden spaces exist, or any Stealth recovery key activity. Your PINs are verified entirely on your device, so the server itself never sees this activity — there is nothing for Guard to receive. Preserving plausible deniability is core to the product, and this is never exposed, to Guard or anyone else.
The identity of anyone you collaborate with, for any workspace or sharing feature not yet available in the app.

Only metadata about actions is shared — never the protected content itself, and never anything that would reveal a hidden space exists.

5. How OXU Guard uses this data

OXU Guard uses this data for one purpose only: assessing and reducing security risk to OXU Note and your organization. Specifically:

To detect security threats (e.g. unusual sign-in patterns, mass device changes, sign-ins from unexpected locations).
To correlate activity across OXU apps for a fuller picture of an incident.
To raise alerts for your security team, so they can act before harm occurs.

This data stays inside OXU's own security systems. OXU Guard never shares, discloses, or transfers this data to any third party — including advertisers, data brokers, or unrelated outside companies. It is never sold, and it is never used for advertising, profiling, or any purpose other than the security risk analysis described above.

6. Data retention & deletion

OXU Guard retains two distinct categories of data, for different durations and different reasons:

Data category	Retention
Raw event values — the activity metadata described in Section 3 (action type, timestamp, success/failure, source IP, etc.)	Deleted after 3 months.
Security outcomes — the rules, alerts, and insights OXU Guard generated from that activity	Retained.

Raw event values are deleted after 3 months once they're no longer needed for detection. Security outcomes are kept because they represent your organization's own security-monitoring record — what Guard detected, and which rule or alert it triggered — so your security team retains a history for review, investigation, and audit.

If your admin Turns Off Data Sharing, all OXU Note data in Guard — including retained security outcomes — is permanently deleted.

7. Your controls

Your Organization Admin controls everything: Turn On, Pause, or Turn Off at any time. Turning this on or off has no effect on your notes, keys, PINs, or Stealth Mode spaces — it only controls the activity metadata described above.

Privacy Policy — see Section 7, "Data sharing and processors" and Section 9, "Data retention".
Terms of Service.

9. Contact

Questions about this integration for OXU Note: [email protected].