SideNote ProSideNote Pro for organisations
Security & privacy, clearly documented.
SideNote Pro sends AI requests to the provider you choose. Application data, credentials and local folder search stay on your own Windows device. For organisations evaluating SideNote Pro, BediniLabs can also provide technical and procurement documentation on request.
Privacy by design
SideNote Pro is a native Windows application and a client for AI services you choose and configure. BediniLabs does not operate an AI backend for it, and there is no SideNote Pro account, cloud profile or hosted conversation service.
When a request is submitted, it goes from SideNote Pro to the AI provider configured in its settings. We are not in that path and do not receive prompts or responses as part of AI generation.
With a local provider such as Ollama or LM Studio running on the same machine, the request goes to localhost and processing can remain on that machine. What SideNote Pro controls is where a request is sent; it does not supply the local model.
The Privacy Policy sets all of this out in full, and BYOK and privacy explains what bringing your own key does and does not change.
The AI provider you configure does receive the requests submitted to it, and handles them under its own privacy, retention and usage policies. BediniLabs does not control those practices, so review them as part of choosing a provider.
Local data and credentials
Application data is stored on the device, under the Windows user’s Local App Data location. It is not uploaded to BediniLabs and is not synchronised between devices.
Provider credentials
Each provider profile’s API key is kept in its own file, protected with the Windows Data Protection API (DPAPI) for the current Windows account, and never written into the settings file. It is sent only to the provider endpoint it authenticates, and never to BediniLabs. That includes a key OpenRouter creates when you choose Connect with OpenRouter: you approve it in your browser, and SideNote Pro collects it on the device.
Conversation history
Threads are stored locally when history is enabled, and history can be turned off. Encrypting the archive with DPAPI is optional and covers attached images, extracted document text, and takeaways with their notes. History can be deleted in the application or pruned automatically after a set number of days. Active Notes are stored apart from history and are encrypted with it when protection is on. Exports of settings and of all conversations are unencrypted files, written only where a user saves them.
Documents
Attached documents are read and extracted on the device, and the original file is never uploaded. Only the extracted text, or PDF pages a user chose to send as images, is sent, and only as part of a request that is submitted.
Local folder indexes
Indexing, search and ranking run on the device, with no embeddings, vector database or hosted search service, and the index is protected with DPAPI. A request carries only the excerpts local search selected.
No filesystem crawling
A folder is only ever one a user added. SideNote Pro does not discover folders, crawl drives, inspect recent files or run background filesystem watchers.
Explicit actions only
Screenshots, pasted images and selected text are read only after an explicit action: starting a capture or pressing the capture shortcut, pasting, or pressing the Selection actions shortcut or an action shortcut. An answer goes back into another application only when a user clicks to return it. There is no passive screen, clipboard, microphone or camera monitoring.
What a request contains
Capturing or attaching content does not send it. A request starts when you press Send, run an inline command, or choose a selected-text action set to send immediately. A request then carries what it needs: the message and the system prompt, relevant earlier messages from the same conversation within the configured context window, and anything attached or captured for it, such as images, text extracted from documents, text from a selected-text action, or the excerpts local search selected from an indexed folder. A request that is only typed text sends only typed text.
Compaction is also a request: when a long conversation is compacted, the summary is produced by the configured provider, so older messages are sent to it for that purpose.
The optional feature is Automatic Takeaways, which is off by default. When a user switches it on, each finished response is followed by a separate request that sends that exchange and a few earlier messages, as text, with the takeaway instructions and the takeaways already kept, to the provider that wrote the response or to a profile chosen for takeaways. It never includes attachments, captured text, folder excerpts or the user’s own notes. Saving a takeaway by hand, and writing a note, send nothing.
A clear service boundary
Three separate parties can be involved when SideNote Pro is in use, and they see very different data. SideNote Pro makes network requests to the AI endpoint configured in its settings and to the BediniLabs licensing service, and they are entirely separate. From version 1.15.1 it also downloads one public file about once a day, https://sidenotepro.com/updates/latest.json, to check for a newer version; an organisation that allowlists outbound traffic should include that address.
SideNote Pro, on your Windows device
- Holds
- Settings, conversation history, attachments and extracted document text, Active Notes, folder indexes, the usage ledger, provider credentials, licensing state, and the device key used to sign licensing requests.
- Connects to
- The AI endpoint you configured, the BediniLabs licensing service and, from version 1.15.1, sidenotepro.com about once a day for the update check. If you choose Connect with OpenRouter, it also contacts openrouter.ai to authorize and collect the key.
The AI provider you configure
- Receives
- The requests submitted to it, and the API key that authenticates them.
- Governed by
- The provider’s own terms and its privacy, retention and usage policies. BediniLabs does not control or audit those practices, and billing for API usage is between you and the provider.
The BediniLabs licensing service
- Handles
- Trial authorization, activation, entitlement refresh and device deactivation. For those it processes licensing and device information: the licence, its registered devices, trial and entitlement dates, and the purchase email. Trial authorization also sends an identifier derived from the Windows installation, and only that derived value is transmitted.
- Never receives
- Prompts, responses, attachments, screenshots, filenames, folder contents, usage figures or AI provider API keys. AI requests do not pass through it, and it is not a proxy for any provider.
The BediniLabs update check, from version 1.15.1
- Serves
- One public file,
/updates/latest.jsonon sidenotepro.com, the same for every installation. SideNote Pro downloads it about once a day with an anonymous request and compares its version number with its own. Updates themselves are installed by the Microsoft Store. - Never receives
- Licence keys, device or installation identifiers, settings, usage figures, cookies, prompts or any other content. Like any request to the website it arrives with an IP address and a time, which the web server’s access log keeps for about two weeks.
Buying a licence online also involves Stripe, which processes the payment, and Brevo, which delivers the licence email. Neither receives conversations or AI provider credentials. Purchase and licensing data in the Privacy Policy sets out what each one handles.
No application telemetry
The SideNote Pro application does not contain telemetry, product analytics, advertising identifiers or marketing SDKs. It does not report usage, feature interaction, crash statistics or device information to BediniLabs. The daily update check from version 1.15.1 is not telemetry either: it downloads a public file and sends no licence key, identifier, settings, usage figures or content.
The usage figures SideNote Pro shows are recorded in a ledger on the device: daily token counts and local cost estimates by provider and model. The ledger holds no prompts, responses, filenames, document contents, images or API keys, and it is not sent to BediniLabs.
Documentation for your review
Organisations evaluating SideNote Pro for Business or Enterprise use can ask us for the material a security, IT or procurement review needs. Tell us what your process requires, and we will confirm what we can provide.
Security & privacy documentation
A written account of how the application handles data, credentials and network connections, consistent with the published Privacy Policy.
Architecture and data-flow information
What runs on the device, which endpoints the application contacts, and what each connection carries.
Software Bill of Materials (SBOM)
SBOM available on request for organisational evaluations.
Technical product documentation
System requirements, provider configuration and licensing behaviour, building on the public setup and usage guides.
Security questionnaire support
Answers to your organisation’s security or vendor questionnaire, based on the documented architecture.
Procurement & vendor review support
Vendor information for supplier onboarding, and quotation and invoicing for Enterprise purchases.
DPA or data-processing documentation where applicable
Whether a DPA is relevant depends on the deployment. What BediniLabs handles is licensing and purchase information and, as for any website, access logs, which include the update check’s requests from version 1.15.1; not conversation content.
Deployment & environment requirements
The Windows version the application requires, how it is distributed, and the network destinations it needs to reach.
To request documentation, email info@bedinilabs.com with your organisation’s name and what your review needs.
This material is prepared by BediniLabs and describes how SideNote Pro is built and how it handles data. Documentation is provided for customer review and does not represent a third-party certification or independent audit.
Need something specific?
Organisational deployments can have requirements that do not apply to individual customers. You can discuss Business and Enterprise deployments directly with us. Where a requirement falls outside the standard product, we can evaluate it and scope the work separately.
Examples of requirements to raise:
- Provider and model defaults
- Deployment configuration
- Organisational settings
- Integration with internal workflows
- Custom licensing requirements
- Other product modifications, scoped individually
These are examples to discuss, not features included with a licence.