A note-taking app access audit should answer four questions: who can open each important note, what they can change, how that access was granted, and whether a copy exists somewhere else. Do not stop at the account's member list. Sharing can be attached to an individual note, a folder or workspace, an invitation link, an integration, or an exported file.
Start with the notes that matter most
List notes that contain operating procedures, customer details, financial planning, recovery information, private drafts, or unpublished work. Add the folder or workspace that contains each note and name its current owner. This creates a bounded review instead of an endless tour through every grocery list and scratch note.
For each important item, record whether it is private, directly shared, or reachable through a link. Then record every participant, whether that participant is a person or group, and whether the role permits viewing, editing, resharing, or inviting others. In Google Keep, a collaborator can edit the note's text, lists, images, drawings, and audio. Apple Notes gives an owner controls for invited people or anyone with the link, view-only or edit access, and whether other participants may invite people. Those controls are similar enough to form a useful checklist, but their exact labels differ by app. See the official Google Keep sharing guide and Apple Notes collaboration guide.
Review grants, not just names
A familiar name does not prove that access is still appropriate. Beside each participant, write the work reason, the date last confirmed, and the narrowest role that still supports that work. Check former employees, contractors, old household members, abandoned team addresses, and groups whose membership is managed elsewhere. A group can quietly expand while the note still shows only one group name.
Inspect public or reusable links separately. Open the sharing panel and note whether a link works for anyone who receives it or only for invited accounts. Check whether recipients can invite others. If the app provides an activity view, use it to compare the sharing list with recent edits rather than treating activity as proof that every inactive account is safe to remove. Apple documents both participant removal and a stop-sharing control; Google Keep also lets the owner remove a collaborator.
Include connected paths and copies
Open the account's connected-app, extension, or integration settings. Record each tool, the account that authorized it, the scope shown by the app, and whether the tool is still used. Also look for browser extensions, automation platforms, mobile widgets, email-to-note addresses, and shared devices that remain signed in.
Exports and offline copies sit outside the live permission panel. Check downloaded archives, PDFs, copied text, screenshots, backups, email attachments, and synchronized folders. Removing a collaborator from a live note does not retrieve a copy that was already exported. Treat that as an inventory fact, not a reason to assume misuse.
Make changes in a controlled order
First preserve ownership: confirm that at least one current account can administer every important note or workspace. Next replace broad links with named invitations where practical, reduce edit rights to viewing when edits are unnecessary, and remove stale participants. Recheck the note from a second authorized account so that the intended reader still has the intended role.
Be especially careful before deleting. Google states that when an owner deletes a shared Keep note, it is deleted for everyone. If the goal is only to end collaboration, use the sharing controls rather than deletion. Finish by recording the review date, the owner, the changes made, and the next check. A short access register turns a one-time cleanup into a repeatable audit.