Security
How Pup Notes protects your practice’s data
Your records include clients’ addresses, their dogs’ behavior and your private notes. This page explains, in plain words, how Pup Notes keeps them safe.
Pup Notes is in development and launching in the US around the end of 2026. This page describes how the service is built to work at launch, and we update it whenever that changes.
Last updated October 15, 2026
Each practice’s records are separate
Pup Notes checks every request against the practice and role of the person making it, and automated tests check that one practice can’t reach another’s records. An email address alone never gives anyone access.
- Within a practice, admins and staff have different permissions. Only admins can change settings, issue refunds or export the practice’s data.
- Clients see only their own household’s records, and never your private notes.
- Web sign-in uses secure, HttpOnly cookies, and the phone app keeps its sign-in in the phone’s secure storage.
Encryption
Data is encrypted in transit and at rest, including backups. Calendar connection tokens are stored encrypted, and Pup Notes reads only busy times from your calendar, not event titles, attendees or descriptions.
Card details stay with Stripe
Card numbers are entered directly into Stripe’s forms and never reach Pup Notes’ servers. Pup Notes receives only limited details, such as the card brand and last four digits. Identity and bank details you give Stripe stay with Stripe.
Photos, videos and documents are private
Files are never public. They are delivered through short-lived links to people who are allowed to see them.
- Uploads are limited to expected file types and sizes and checked for malware.
- Location and other hidden details are removed from uploaded photos.
Dictation and AI drafting
Voice notes and typed notes are sent to OpenAI in the United States to transcribe and draft. OpenAI doesn’t use them to train its models and doesn’t keep the audio. It may keep drafting requests for up to 30 days to monitor for abuse, then deletes them.
- Pup Notes deletes the raw audio within 24 hours of recording.
- Pup Notes doesn’t identify or separate speakers by their voice.
- Every draft stays private to your team until a trainer accepts it.
Logs and analytics leave out your content
Usage analytics are limited to a reviewed list of events and never include note, message, incident or transcript content, or names, addresses and phone numbers. Error reports are configured to exclude personal information and record content. Pup Notes doesn’t record screen sessions in the signed-in apps.
Access by Pup Notes staff
Access by Pup Notes personnel is limited to what support and security need, and it is recorded in an audit log. Changes to access, money, exports and deletions are recorded too.
Backups and deletion
Backups are deleted automatically within 35 days, and deleted data is not restored from a backup. When a practice closes its account, its data is deleted 30 days later, except records that must be kept for financial, tax, legal or security reasons.
If something goes wrong
No system is perfectly secure. If a security incident affects a practice’s data, Pup Notes notifies the practice owner within 72 hours of confirming it, so the practice can tell the people affected. We notify people directly when the law requires us to.
Report a security problem
If you think you’ve found a security problem in Pup Notes, email us. Please don’t include anyone’s personal information in your message.