Quick answers on trust

No. Note bodies and attachments are encrypted in your browser before anything is uploaded — the service stores ciphertext it cannot read.

The one real exception is AI chat. If you use it, your prompt and the relevant conversation context are sent as plaintext to the AI provider for processing, and your chat history is stored as plaintext in your own browser rather than encrypted at rest. That is a genuinely different privacy posture from notes, and it applies only to chat.

There is no open-source or self-host promise. What you can rely on is your own export, which you can run at any time. See ‘What happens to my data if Ma’atara shuts down’ for the full answer.

Your identity is not tied to one device. Pair a second device ahead of time so you always have a working one, or restore your identity on a fresh device with your recovery phrase. There is no per-device switch in Provenance today: the device list on your account page is fed by a store that has been retired, so there is nothing there to revoke. The remedy for a lost device is the same one that covers a device whose key material has already been copied off it — rotate your key where your identity was created (in Parable, Settings › Security), which retires the old key everywhere immediately. Work a device signed while trusted stays valid, because it genuinely was signed while trusted. See ‘Signing in on another device’.

If you still hold a device that already has your identity unlocked, you are fine — use that device to set up a new one and note the phrase down properly this time. If you lose the phrase and every device that holds the derived keys, nobody can recover it for you, including Ma’atara. There is no “forgot password” link, because a link that could reset your identity is a link that could let someone else take it. This is the direct cost of nobody but you holding the key. See ‘How identity works here’.

This is the member’s side of a control organisations already have: removing a member is unilateral and immediate — the organisation does not need your agreement to end that relationship, the same way it did not strictly need your agreement to begin it (though it did need you to accept the invitation).

What it does not touch is your personal Ma’atara identity. An organisation never holds your signing key — only the browser origins you deliberately set up or paired (the identity portal among them) do, and only you control those — so removal ends your standing and access within that organisation, not your identity, your recovery phrase, or your own devices. Anything you signed while you were a member stays validly yours; it was genuinely signed while the relationship existed.