What security and compliance standards does Napkin meet?
Napkin is SOC 2 Type II compliant and ISO 27001 certified. Napkin is also GDPR compliant. You can find more about our security and data protection practices in our Trust Center and Privacy Policy.
Where can I see the reports and certificate?
Visit our Trust Center to request access to the SOC 2 report, ISO 27001 certificate and GDPR documentation. These documents are gated, and access is subject to our team's review and approval. We'll review your access request and respond by the next business day.
Is my content used to train Napkin's AI?
For self-serve accounts, Napkin may use anonymized interaction data to improve its AI. You can opt out in your privacy settings. Enterprise customer data is not used to train Napkin's AI. See how to manage your training preferences.
What happens to the files and text I upload?
We process your content and instructions to provide Napkin's AI features. Depending on the feature, this may involve AI services from providers such as Google, OpenAI and Anthropic, or models Napkin runs on Google Cloud. We do not permit our AI inference providers to use Customer Personal Data to train their general-purpose models. See our sub-processor page for provider-specific details and our AI Transparency notice for more on image generation.
Where is my data stored?
Napkin hosts your data on Google Cloud infrastructure in the United States. Some service providers may process personal information in other countries. See our Privacy Policy for more on international data transfers.
How long do you keep my data, and how do I delete it?
Account-related data is kept while your account is active. When you request account deletion, most personal data is scheduled for deletion from active systems immediately. Some records and backups may be retained for legal, security, or operational reasons. For the full retention details or to request deletion, see our Privacy Policy or contact [email protected].
How does Napkin protect my data?
Data is encrypted in transit using HTTPS/TLS, and sensitive data is encrypted at rest. We use role-based permissions to limit internal access. Administrative access is protected by strong authentication, access logs are regularly reviewed, and systems are monitored for suspicious activity.
Who can access my content?
Internal access to user data is limited to authorized personnel who need it for operational or support purposes. We also work with service providers to run Napkin and deliver its features. Our Privacy Policy explains how personal information is used and shared, and our sub-processor page lists providers that process Customer Personal Data.
Do you offer a Data Processing Agreement (DPA)?
Yes. Our Data Processing Agreement forms part of our Terms of Service and applies when you create an account or use Napkin.
Who do I contact about security or privacy?
For security concerns, privacy questions, or requests about your personal data, email [email protected]. You can also contact our Data Protection Officer at [email protected].