Security. What Marker does to keep your library yours alone, in plain words.
If it isn't on this page, we don't claim it.
Every account is walled off.
Your saves, notes, Spaces and highlights are stored against your account, and the database enforces row-level security: a query only returns rows that belong to the signed-in person. The database checks this itself, not just the app.
Database functions answer only to you.
The functions that work on your data can only be called by a signed-in user, and they check that you own what they touch. Background work runs under a separate service identity the public can't call. An automated check fails if any function becomes callable without signing in.
Device and AI-tool tokens are stored as hashes.
When you pair the browser extension or connect an AI tool, its token is shown to you once. Marker keeps only a one-way hash, so a copy of the database wouldn't contain working tokens. Revoke any device or tool from Settings.
Your own API keys are encrypted at rest.
If you add your own AI provider or page-reading key, it's encrypted before it's stored, and the app only ever shows its last four characters.
Secrets stay out of the code.
Every change to Marker's code is scanned for leaked keys and passwords before it's accepted. The full history has been scanned as well.
The extension acts only when you ask.
The browser extension reads your bookmarks, and your own saved items on social sites through your own signed-in session, when you start a sync or turn on Auto Sync. It never sees your passwords and doesn't record your browsing history.
You can leave with everything.
Export everything on Pro, or ask us for a copy on any plan, and delete your account from Settings.
What we don't claim.
Marker doesn't hold security certifications such as SOC 2 or ISO 27001. Your saved content is sent to AI providers so it can be summarised, tagged and searched; the privacy policy explains this and will list those providers.
Found a problem?
Please report security issues to [security email]. You'll get a reply, confirmed issues will be fixed, and you'll be credited if you'd like.