LoginSign Up
← Back to all sparks
J

Joplin

COLLAB
Velocity5.0

Open-source note-taking and to-do application with end-to-end encryption and multi-device sync

joplinapp.org ↗

Joplin fixes 50+ server security issues found in a Claude-assisted review of Joplin Cloud.

note-takingsecurityprivacyself-hostedopen-source
◆Current state
Joplin added AI in 3.7 (chat, semantic search, MCP), all opt-in, and has since named Mistral's EU endpoint as the provider behind Joplin Cloud AI. Its November 2 post reports a full review of Joplin Server, which also runs Joplin Cloud, done with Claude through Anthropic's Cyber Verification Program: no critical findings, but more than 50 high, medium and lower issues fixed. Self-hosters need 3.7.4 or later, which changes LDAP and SAML sign-in behavior.
◆Where it's heading
Joplin's recent posts are about trust: privacy terms for AI, a named data processor, and now an audited server. The product is positioning its cloud as safe to put notes in while feature releases stay on a roughly four-month cycle.
◆Prediction
The next feature release, around 3.8, would fit the four-month cadence in early 2027; the security post suggests more server-side hardening will land in point releases before then.

◆Recent moves

  1. 12d ago

    A full security review of Joplin Server and Joplin Cloud

    A Claude-assisted review of every Joplin Server route found no critical bugs but led to more than 50 fixes in sign-in, password reset, 2FA, sharing and publishing. Cloud users are already covered; self-hosters must move to 3.7.4, where LDAP accounts lose local passwords and sign-up closes when SAML or LDAP is on.

    View source ↗
  2. 24d ago

    How we protect your privacy with Joplin Cloud AI

    The second privacy post since 3.7, and the first to name the vendor: Mistral via its EU endpoint, with zero data retention and no training on notes. It turns September's general opt-in promise into specific commitments for the hosted AI path.

    View source ↗
  3. 2mo ago

    Your notes and AI: privacy first

    Joplin published an explicit privacy statement for its new AI features: AI is opt-in, only the relevant note content is sent to cloud providers, and local models prevent any external data transmission. This documentation is tightly coupled to the 3.7 release and frames the product's AI stance as a deliberate competitive position — relevant for the professional users Joplin is targeting.

    View source ↗
  4. 2mo ago

    What's new in Joplin 3.7

    ⚡ SPARK

    Joplin 3.7 is the product's AI entry point — chat, semantic search, and MCP in a single release, all built around a privacy model that keeps AI off by default and supports local models. This is the moment Joplin moves from a capable note-taking app to a serious contender in the AI-native knowledge base category.

    View source ↗
  5. 6mo ago

    What's new in Joplin 3.6

    Joplin 3.6 addressed the OneNote import path — historically one of the main friction points for users leaving Microsoft's ecosystem — and continued incremental Markdown editor stability work. Mobile improvements narrowed the gap between desktop and mobile experiences. These are the foundational quality improvements that make 3.7's AI features feel like they belong in the product rather than being bolted on.

    View source ↗
  6. 8mo ago

    Introducing our Warrant Canary

    Joplin introduced a signed warrant canary — a regularly updated statement confirming no secret legal orders have been received. No product functionality changes; this is a transparency mechanism for users who need verifiable assurances about legal access to their data. It's consistent with Joplin's broader privacy positioning but doesn't affect the product itself.

    View source ↗