Every vault says “bank-level security.” Here's what ours actually does.
The promises families hear from document vaults, side by side with how HearthVault handles each one — including the live numbers from our own system. Updated 2026-10-21.
Yes — and one layer deeper. Every file is encrypted by HearthVault itself with AES-256-GCM under its own key before it ever reaches storage. The storage provider holds only ciphertext, on top of its own disk encryption.
Yes. Passwords, account and policy numbers, balances and legacy letters are encrypted again as individual fields, so a database copy alone can't read them.
Yes — modern TLS 1.2+ (1.3 preferred) with HSTS on every request. “SSL” is the older name for the same idea.
Each household lives in its own database scope and every file has its own key. An unlock token for one household is rejected everywhere else — isolation enforced at the data layer, not by policy.
No HearthVault staff has standing access to vault contents. Administrator actions need a separate PIN or passkey and are written to a hash-chained activity log you can read. Our AI reads a document once, in memory, to name and file it — nothing is kept by the model provider.
Yes. Google Cloud via Emergent (SOC 2 Type I audited infrastructure) — SOC 2 Type I audited infrastructure, US region. Every sub-processor and its region is listed in the Trust center.
Passkeys and hardware security keys for unlock; government-ID + liveness verification before an executor can request release; a 48-hour waiting period the owner can veto.
Three honest footnotes
Documents aren't zero-knowledge. To name, file and search a document, our server must decrypt it in memory for a moment. Passwords and account numbers get a second, field-level lock with a key kept outside the database — but the server, not your browser, holds that key.
We don't advertise background checks. HearthVault is built so that no person needs standing access to your vault in the first place; every Administrator action is logged where you can see it.
Our own SOC 2 is in progress. The infrastructure we run on is SOC 2 Type I audited today; HearthVault's product-level readiness pack is published in the Trust center.
Want the full picture?
Sub-processors, incident response, how AI is used and the downloadable whitepaper live in the Trust center.