iPad: Secure Note-Taking

Limitations built into iOS on the iPad, iPhone, or iPod make it quite difficult to move data in and out of the devices in a secure manner, because we often have to rely on a third party somewhere in the cloud to accomplish it. Don’t be discouraged, though! You can get work done on iOS without sacrificing your security. When I originally posted this nearly two years ago, I recommended VoodooPad, but that app seems to have been abandoned, and I think the leader now is DEVONthink, so I have rewritten the post to reflect these changes.

スクリーンショット 2015-06-23 8.28.10

Why Bother With Security?

I’ve written before about privacy, security, and your data in response to the Snowden leaks. I’ve also suggested some ways that you can maintain your privacy on the Internet when you are using a computer. Although my posts may not have convinced you that it is worth the effort to protect yourself, you could also have legal obligations to handle other people’s data securely (locked in some manner to ensure privacy).

For example, I am legally compelled by NDAs (non-disclosure agreements) with companies and FERPA (“Family Educational Rights and Privacy Act” 20 U.S.C. § 1232g; 34 CFR Part 99) to take certain precautions with data, though it isn’t always clear what this might entail. You might be wondering, “isn’t the cloud good enough?” I am afraid not. Most of the major mobile applications these days encrypt data when sending it, and they keep it encrypted on our devices, but very few of them encrypt it in storage on their servers in the cloud, and even fewer have a zero-knowledge policy (meaning that only you have the encryption key and neither the company nor the government has access to the data). I think this situation has prompted some universities to prohibit faculty from using popular services such as iCloud, Dropbox, and Evernote to store private data. Dropbox itself says it is not FERPA compliant.

What could go wrong if you upload un-encrypted data into the cloud (through email or a cloud storage service)? Besides getting hacked, employees at the service provider, or a contractor hired by them could gain legal/illegal access to it. At Google, for example, one employee lost his job for using his position at the company to snoop on the Gmail and chat transcripts of minors. When you put your data on the cloud, you share it not only with the employees who work there, but any integrated services you give permissions to (how many services do you have connected to your Dropbox account?), and possibly the many tens of thousands of government employees who can view all of the data the government collects on a daily basis. And, once data has escaped your control, there is no getting it back.

When educational institutions offer guidance, they often restrict faculty to use of services they have contracted (FERPA allows for this), and forbid them from placing student data in personal accounts with cloud services (see The University of Michigan and The University of Minnesota, for example). This doesn’t set my mind at ease, because educational institutions have encountered egregious privacy violations in the past, the entire system of outsourcing services to Google and Microsoft exploits student data for corporate gain, and they regularly get hacked, but I am glad to see that they are at least trying take the security of their student’s data seriously and are willing to offer clear solutions to their faculty for managing it.


I want to stress that I am not an expert on these matters! For example, Evernote is not HIPAA (Health Insurance Portability and Accountability Act) compliant, but what about FERPA? Frankly, I don’t know for sure, but if Dropbox is not, I don’t know why Evernote would be in compliance (based on what I know about how the two services work). Clearly, other educators have different interpretations of the relevant laws, as seen, for example, on the Evernote blogs, where one user suggests we “[s]can graded tests, including scantrons and add them to Evernote.”

However, I have a narrower reading (perhaps too narrow) of the relevant sections of FERPA that prevents me from adopting the suggestion without modifying it to at least recommend encrypting each scanned file. This is the solution I have adopted and suggested for other educators over the past couple of years. Unfortunately, it does not scale especially well, and it could be an overly cautious approach.

If in doubt, I would recommend following Evernote’s advice on the subject; namely, they write that you should “ensure that you are complying with The Family Educational Rights and Privacy Act and any local laws and policies the school may be required to follow.” I prefer to play it safe in terms of the laws, but my narrow reading of FERPA also aligns with my own opinion on how we ought to treat any data, especially data entrusted to us by others: ENCRYPT AS MUCH AS POSSIBLE.

Note-taking: DevonThink and VoodooPad

To the best of my knowledge, only two note-taking applications, DevonThink and VoodooPad, enable you to encrypt all of your notes. I especially like the position that DevonThink has taken in response to the Snowden leaks: “Since Edward Snowden’s disclosures privacy has become a top priority for many people. Our users use our apps for confidential documents and so care a lot about where and how their data is stored. We give our users control over their data and, starting with DEVONthink 2.7, we also safely encrypt everything that we store outside of the user’s computer.”

Although some other apps in the appstore claim to offer total encryption, they have no way to search, navigate, or move your notes off the iOS device — I’d say that they function more as secure memo pads than practical note-taking applications.

  • DevonThink
    • In the initial version of this post, I gave my opinion on the DEVONthink To Go app for iOS based on its ratings in the appstore. I eventually broke down and bought it in order to see for myself, and I can report that it is not as bad as it sounds in the reviews. I’ve actually found it to be adequate for my needs, and I am quite pleased with its ability to sync without the cloud (wifi or Bluetooth) — it is about as secure as you can get on the iPad. There is an encrypted Dropbox sync for the Mac as well (using 256-bit AES encryption).

  • VoodooPad
    • VoodooPad appears dead now, with no significant development since it was turned over to Plausible Labs. Users have been reporting incompatibility issues with Yosemite (the latest Mac OS), and I recommend staying away from it for now. When it was working, it used to be pretty nice with encryption of both “pages” (notes or files) and “documents” (notebooks or folders). Plausible Labs support also confirmed that it uses 128-bit AES encryption. Because VoodooPad syncs through WiFi, iTunes, or Dropbox it had a lot of options for users. Alas, it looks like those days are gone.

If you have a Mac/iOS combination, one cool thing you can do is to use Evernote, nvALT, and DevonThink all together by having DevonThink index the various databases. This gives you the power of DevonThink’s search capabilities along with the benefits of the other apps. In VoodooPad, if you have your Document encrypted, go to Pages->Info->Document->Make Document searchable from Spotlight to make sure it can be found from there.

One of the obvious downsides to these solutions is that the desktop versions of both VoodooPad and DEVONthink are only available on the Mac, so Windows users are out of luck. I suppose you could get by with only using the iOS version of either one, but the experience over the long-term would be quite unpleasant. Like all iOS apps, they are quite restricted in terms of functionality, and work best in conjunction with their desktop counterparts.

What About Evernote or nvALT?

Although I strongly recommend note-takers consider Evernote and nvALT, and I have written extensively about the benefits of using them on my blog (see these for Evernote and these for nvALT), you also have to take into account your individual situation. Evernote and nvALT (I recommend syncing through Dropbox with Notesy on iOS) offer great note-taking solutions for people who don’t need to encrypt data.

Ideally, of course, Evernote would get encryption (the CEO promises “sexy” encryption features soon) and nvALT would develop an iOS app that could read its encrypted databases (it offers encrypted databases for Dropbox, but these cannot be opened by any iOS apps at the moment). Encryption would just work and we wouldn’t have to think much about it.

We can only use the apps we have, though, not the ones we wish we had. At the moment, Evernote and nvALT cannot handle sensitive data on iOS without some effort on our part (encrypting each sensitive file individually).

Related Resources