Trust & security
Built around privacy, trust, and clarity.
Your information stays minimal by design. We hold only what your family needs to find what you left them — and nothing more.
We hold what’s needed to point your family in the right direction — and not a byte more.
Architecture at a glance
Two numbers describe almost everything about how we handle your information: the strength of our encryption, and the number of credentials we will ever ask you for.
What we keep. What we never touch.
Two lists. That is the entire data model.
We deliberately separate the few things we hold from the many we don’t. The line is drawn at the minimum your family needs to find each account — and nowhere further.
What we store
- Institution names The bank, brokerage, retirement plan, or insurer that holds an account. The minimum required to give your family direction.
- Beneficiary contact details Names, relationships, and how to reach each loved one when the time comes. Encrypted at rest with AES-256.
- Your instructions in your own words What to ask, who to call, what to reference. Written by you, released only to the named beneficiary.
- Optional reference numbers Only if you choose to add them. Account numbers and policy IDs are entirely optional. When stored, they are encrypted with AES-256.
What we never touch
- Passwords or PINs We do not ask for, transmit, or store any login credential. There is no field to enter one. There never will be.
- Account balances We do not connect to your accounts, scrape statements, or hold balance information of any kind.
- Banking sessions or tokens No Plaid, no OAuth bank-link, no session credentials. We are pointedly outside the access path.
- Your beneficiaries’ data, ever Until verification completes, your beneficiaries are unaware of the vault. Nothing is pushed to them prematurely.
Verification, step by step
Nothing is released until each step is complete.
The release of guidance is the only moment when your data leaves the vault. We designed that moment to be slow, careful, and reversible.
-
We check in with you, on your schedule
Annual, quarterly, or monthly — you choose. Each check-in is one click to confirm all is well, and simply signing in counts too. As long as we hear from you, nothing else ever happens.
-
A concern opens a review — never a release
If a check-in goes unanswered, or someone who knows you reports a concern, a human opens a verification case. Reports are never taken at face value, and we never confirm to anyone whether an account exists.
-
We try to reach you, repeatedly
Email outreach with one-click confirmation, spaced over days. Nothing is shared while we wait. Responding — or signing in — stops the process immediately, at any stage.
-
Release is slow, final-noticed, and human-approved
If we cannot reach you, a person — not an algorithm — approves the release, and a 72-hour final notice goes to you first. Any sign of life cancels it automatically. Only then does each beneficiary receive the guidance you wrote for them — and only theirs.
You stay in control. Always.
- Edit at any time. Update institutions, beneficiaries, or instructions whenever life changes. Nothing is locked in. Nothing is permanent without your consent.
- Revoke at any time. Remove a trusted contact, a beneficiary, or the entire vault. The data is deleted; the audit trail of the removal is retained.
- Encryption you can verify. AES-256 in transit (TLS 1.3) and at rest. The infrastructure follows the same baseline used by major financial institutions.
- Sensitive details optional. Account numbers and policy IDs are not required. Many families need only the institution name and a clear instruction in your own words.
- No premature alerts. Notifications are released only after verification completes. Mistaken or premature alerts are prevented by design.
Begin today
Protect your family from confusion and uncertainty.
Set it up once. Stay ready, quietly. We hold the map; you hold the keys.