Goodnotes Limited

Hong Kong · www.goodnotes.com · 34 vendors

Resilience scores

Technology vendors

Services catalogue

3 services in catalogue across 2 categories; runs on 34 sub-vendors.

Insights

Last updated 2026-08-05 · revision 7

34 direct vendors, 308 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Goodnotes exhibits a good foundation for migration readiness, largely attributable to its modern, cloud-based infrastructure on Amazon Web Services (AWS) and the advanced nature of its key technologies such as Generative AI, real-time collaboration, and cross-platform sync. This suggests an architecture that is likely modular and adaptable, which is conducive to migration or modernization efforts. The company also benefits from a geographically diverse set of underlying service providers from six unique countries, which generally reduces overall vendor lock-in risk. However, several factors introduce complexity and reduce overall migration readiness. The most significant challenge stems from explicit data residency requirements, particularly those driven by GDPR, which restrict data transfers outside EU, UK, or adequacy jurisdictions without appropriate safeguards. This necessitates meticulous planning for data movement and storage during any migration. The dependency on iCloud for a core sync functionality also represents a potential integration challenge if a migration involves moving away from Apple's ecosystem. Furthermore, the lack of available revenue data makes it impossible to assess the financial capacity to fund a potentially large-scale migration project. While not a direct impediment, the 'Assessment Required' status for SOC2 and ISO 27001 certifications could become a compliance hurdle, especially with enterprise customers, if not addressed before or during a significant migration. The 'Vendor Lock-in Risk' being unknown is also a potential blind spot.

Compliance

9 in-scope frameworks identified; showing 3.

Hong Kong PDPO — Compliant

Goodnotes has published a dedicated Hong Kong Addendum Privacy Policy (last updated July 2025) that explicitly addresses compliance with the PDPO and its six Data Protection Principles. The company's original HQ was in Hong Kong, and it continues to serve Hong Kong residents. Risk is Medium rather than Low because: (1) the PDPO was significantly amended in 2021 with new doxxing provisions and enhanced enforcement powers for the Privacy Commissioner; (2) cross-border data transfer provisions under PDPO are evolving; (3) the Hong Kong Notice explicitly acknowledges cross-border data transfers outside Hong Kong, which requires user consent under PDPO; (4) the Privacy Commissioner for Personal Data (PCPD) has increased enforcement activity. Fines and criminal liability under the amended PDPO are significant.

Evidence: https://www.goodnotes.com/hong-kong-addendum-privacy-policy, https://www.goodnotes.com/hong-kong-addendum-privacy-policy-chinese, https://www.goodnotes.com/privacy-policy

SOC 2 (source) — Compliant

Goodnotes has confirmed SOC 2 Type II certification, which is the most rigorous level of SOC 2 attestation (covering operational effectiveness of controls over a period of time, not just design). This is directly evidenced by: (1) SOC 2 Type 2 badge on the company homepage; (2) SOC 2 Type 2 listed as a compliance item on the Trust Center; (3) SOC 2 Type 2 report available for download via the Trust Center (requires access request). As a cloud SaaS provider processing user data, SOC 2 is highly relevant and the company has demonstrably achieved certification. Risk is Low because the certification is confirmed and the company uses a continuous compliance platform (SafeBase/Drata) to maintain its security posture.

Evidence: https://www.goodnotes.com, https://compliance.goodnotes.com/, https://compliance.goodnotes.com/?itemUid=fa950d02-cbb3-4010-b917-7137a7c2a982&source=click

GDPR (source) — Compliant

Goodnotes is a UK-registered company (Canary Wharf, London) that explicitly serves EU/EEA residents and processes their personal data at scale across 50+ countries. GDPR applies as a matter of law due to the targeting of EU data subjects. The company has published EU Supplemental Terms, a Data Processing Addendum, a German-language Privacy Policy and Terms, and displays GDPR compliance on its Trust Center (powered by SafeBase/Drata). These are strong indicators of active compliance. Risk is rated Medium rather than Low because: (1) the company is not EU-headquartered and relies on UK GDPR post-Brexit, meaning EU adequacy decisions and SCCs remain relevant for cross-border transfers; (2) AI features (Goodnotes AI) introduce additional data processing complexity under GDPR Article 22 (automated decision-making) and the forthcoming EU AI Act; (3) no public DPO appointment has been confirmed; (4) enforcement risk from EU DPAs against SaaS providers remains elevated. Fines under GDPR can reach €20M or 4% of global annual turnover.

Evidence: https://www.goodnotes.com, https://compliance.goodnotes.com/, https://www.goodnotes.com/data-processing-addendum, https://www.goodnotes.com/terms-and-conditions, https://www.goodnotes.com/german-privacy-policy, https://www.goodnotes.com/german-terms-and-conditions, https://www.goodnotes.com/privacy-policy

Financials

Three-year financials

Financial Resilience Score: 7/10

Goodnotes exhibits above-average financial resilience for a private software company, though hard financials are not publicly disclosed. The company describes itself as bootstrapped and profitable from day one, having operated for roughly a decade before taking a single US$6M seed round from Race Capital in 2020. This low-dilution, cash-generative track record implies strong unit economics and limited reliance on external capital. Scale is meaningful: 25M+ monthly active users across 190+ countries, 400+ employees in 40+ countries, and multiple Apple/Google 'App of the Year' recognitions provide a durable distribution moat, particularly within the Apple Pencil/iPad ecosystem. The business model is diversifying from a legacy one-time US$7.99 in-app purchase to a hybrid subscription model (Goodnotes 6, launched Aug 2023), a digital-stationery Marketplace with revenue-share (e.g., Hello Kitty collaboration), a sticker shop, and enterprise/team tiers. This multi-engine monetisation reduces single-SKU risk. Recent capital deployment — US$1.9M invested in Korean WeBudding (Sep 2023) and the Dropthebit AI acquisition (Jan 2024) — signals available cash and a deliberate build-out in AI and APAC digital stationery. Risks weigh against a higher score. Platform concentration on Apple's ecosystem exposes the company to App Store fee changes and native competition (Apple Notes, Freeform). AI features likely depend on third-party LLM APIs, creating a variable-cost margin risk as usage scales. The subscription transition can drive churn among legacy one-time buyers. Financial opacity — no published consolidated accounts — limits external verification, and Hong Kong entity exposure carries some geopolitical/regulatory tail risk, partly mitigated by the London HQ move.

Key strengths: Bootstrapped and profitable from day one (per company), Only US$6M raised externally (Race Capital seed, 2020), 25M+ monthly active users across 190+ countries, 400+ employees across 40+ countries with London HQ, Multi-engine monetisation: subscription, Marketplace, enterprise, stickers, Category leadership: Apple iPad App of the Year 2022; Google Play Best of 2025, Enterprise-grade compliance (SOC 2 Type II, ISO 27001, GDPR, CCPA), Cash available for M&A (Dropthebit acquisition, WeBudding investment)

Risk factors: Heavy platform concentration on Apple iPad/Apple Pencil ecosystem, Competition from Apple Notes/Freeform, Notability, Nebo, Notion, ChatGPT, AI feature costs tied to third-party LLM APIs pressure margins, Business-model transition from one-time IAP to subscription risks churn, Consumer discretionary exposure via student/stationery segment, No published consolidated financials limits external assessment, Hong Kong entity exposure to HK/PRC regulatory shifts, Only one disclosed funding round; cap table and valuation opaque

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report