How we protect the most sensitive papers a family owns.
This page is our security posture in plain English — what is encrypted, who can see what, which vendors touch your data and what happens if something goes wrong. Updated 2026-09-21.
Encryption
TLS in transit. Passwords, balances, account holders, legacy letters and Gmail tokens are Fernet (AES-128-CBC + HMAC) encrypted at rest with a key that never leaves the server. Backups are AES-256 zips you passphrase yourself.
Access control
Every household member has a personal PIN (bcrypt-hashed), roles (owner / partner / executor), idle auto-lock, brute-force lockout and optional emailed one-time codes for the owner. Advisors get read-only access that the owner can switch off.
Household isolation
Each household lives in its own database; unlock tokens are bound to one household and rejected everywhere else.
Audit trail
Unlocks, reveals, exports, emergency access, advisor views and billing events are written to an activity log every owner can read.
Zero tracking
No analytics scripts, ad pixels or third-party fonts. One essential cookie. We don't sell or share data.
Portability & deletion
One-click encrypted backup of every file and record. 'Erase vault' overwrites every stored file and drops every record — no retention beyond 30-day operational backups.
Incident response
Affected owners are notified by email within 72 hours of a confirmed breach, with what happened and what to do.
SOC 2
PlannedA SOC 2 Type I audit is planned once our first enterprise partner requires it. Until then this page, our privacy policy and a third-party penetration test summary are available on request.
Sub-processors
Every third party that may process your data, and why.
| Vendor | Purpose | Region |
|---|---|---|
| Emergent object storage | Encrypted-at-rest file storage for uploaded documents, photos, voice letters, tribute videos and backups | US |
| MongoDB | Metadata, extracted fields (secrets Fernet-encrypted) and activity log | Same region as the app |
| Google Gemini (via Emergent) | AI extraction, Ask-your-vault answers, obituary and thank-you drafts; processed transiently, not used for training | US |
| Fal.ai (via Emergent) | Royalty-free background music generated for tribute videos (no personal data sent — only the mood you pick) | US |
| Stripe | Subscriptions, billing portal and Financial Connections bank linking (we store last-4 and encrypted balances only) | US |
| Resend | Transactional email: reminders, invites, unlock codes, shared links, inbound email filing | US |
| Twilio | Optional text messages: unlock codes, shared links, text-to-vault filing (only when you connect your Twilio account) | US |
| ElevenLabs | Optional read-aloud voices and voice cloning for legacy letters (only when you connect your ElevenLabs account) | US |
| Google (Gmail · Drive · Calendar · Places) | Optional attachment import, Drive folder sync, renewal reminders in your calendar, and nearby funeral-home lookup | US |
| Plaid | Alternative bank-account inventory when enabled (dormant by default) | US |
| Rocket Lawyer | Optional partner API for will, trust and POA interviews (only when partner credentials are configured) | US |
Need a security questionnaire answered?
Advisors, insurers and employers: email us and we'll return the completed questionnaire and our latest penetration-test summary.