Security & Privacy
Privacy by default, not as an opt-in
This list is what we actually do. What we don't do is written below too — including the four things we will never do.
What we do
Sensitive fields encrypted at rest
Sensitive values such as account clues are encrypted with AES-256-GCM, each row with its own initialisation vector, and the key version is recorded so keys can be rotated safely later.
Two separate keys
The index hash used to find your records (HMAC) and the encryption key used to decrypt content are independent. They are never shared, so a single point of failure can't compromise both.
Always masked on display
Phone numbers, emails and account clues appear only as masked values in lists, the family view, exports and audit records — the full original is never shown back.
Every view is logged
Any look at sensitive information is written to the audit log — recording only the action, the object and the field name, never the field value.
Chats are not kept by default
The raw text of entry conversations is not saved by default; only the structured result, stripped of sensitive detail, is kept. Whether to retain the original is your call.
De-identified before it reaches AI
Before we call a third-party model, fragments such as phone numbers, ID numbers, bank cards, private keys and seed phrases are replaced with placeholders — only the de-identified text leaves our system.
Red lines
Four things we will never do
We are not a password manager
We don't autofill logins, and we don't take over your accounts. To record a password, use encrypted entry — it's stored encrypted, and your family can only see it with your authorisation.
We never take custody of assets
The platform never holds, controls or operates any of your assets or accounts on your behalf.
We don't do automatic inheritance
There is no death verification, threshold sharing or mechanism that opens sensitive information on its own. Reminders go to people — they never hand over access.
We don't claim server-side zero-knowledge
We don't promise what we can't deliver. Sensitive information is encrypted and held on our servers, so a decryptable code path exists — it is tightly restricted and audited.
This page describes the product's current technical measures and boundaries; it is not a guarantee against any particular security incident. A privacy policy and terms of service will be published with the general release.
Write it down — passwords stay encrypted in your hands
You only need to note what you have, roughly what it's worth and how it should be handled. The rest stays with you.