Where your family's papers actually live.
No legalese. This page says, in plain English, where each kind of data is kept, who can reach it, and how to take all of it with you.
Where it is stored
Your documents
Every file is encrypted on our servers with a key unique to that file (AES-256-GCM) before it is written to storage. The encrypted blobs live in US-region object storage. Nobody at HearthVault — and not the storage provider — can open them: the keys never leave our application servers and the master key is rotated on a schedule.
The index (titles, dates, reminders, your plan)
Stored in a MongoDB Atlas database in the United States, encrypted at rest and in transit. Sensitive fields such as account numbers are additionally encrypted at the field level, so a database export alone is not readable.
Backups
Encrypted snapshots are kept in the same US region for 30 days. Backups never contain unencrypted document contents.
Region: United States. We do not currently offer EU or Canadian residency; if that matters to your family, tell us and we will let you know when it does.
Who can reach it
- You and the people you invite
- Owners, partners and viewers unlock with their own PIN or passkey. An executor sees only what you release, only after the waiting period you set.
- Executors and trusted contacts
- Nothing is visible to them until a release is triggered — by you, by your inactivity rules, or by an approved emergency request — and every access is logged.
- HearthVault staff
- Cannot read documents. Support can see account status, plan and activity timestamps to help you; they cannot see file contents, extracted fields or passwords.
- Sub-processors
- Email, SMS, payments, identity verification and address lookup providers receive only the minimum needed for their job (an email address, a phone number, a payment token). None receives your documents. The full list is on the Trust page.
- Governments and courts
- We respond only to valid legal process served on HearthVault, we notify you unless legally barred, and we can only hand over what we can read — which does not include your documents.
Taking it with you
Any owner can download every document and a readable index as a single encrypted archive at any time, and can erase the vault permanently — files, index and backups are purged within 30 days. Leaving never requires talking to us.
Questions about where something lives? Ask us — a person answers.