Trust & security
Built around privacy, trust, and clarity.
Your information stays minimal by design. We hold only what your family needs to find what you left them — and nothing more.
We hold what’s needed to point your family in the right direction — and we keep that list deliberately short.
Architecture at a glance
Two numbers describe almost everything about how we handle your information: the strength of our encryption, and the number of logins to your accounts we will ever ask for.
What we keep. What we never touch.
A deliberately short list. And a line we don’t cross.
We deliberately separate the few things we hold from the many we don’t. The line is drawn at the minimum your family needs to find each account — and nowhere further.
What we store
- Institution names The bank, brokerage, retirement plan, or insurer that holds an account. The minimum required to give your family direction.
- The people you name Names, relationships, and how to reach each loved one when the time comes. Stored encrypted at rest.
- Your instructions and private messages What to ask, who to call, what to reference — and any personal message you leave. Written by you, encrypted at the field level, and released only to the named beneficiary.
- Optional reference numbers Only if you choose to add them. Account numbers and policy IDs are entirely optional. When stored, they are encrypted at the field level under a separately held key — on top of at-rest encryption.
- Documents you choose to attach Held only for delivery to the person you picked, after human-reviewed verification.
- Membership basics Your email, name, check-in schedule and responses, subscription status, and any support messages you send us. Payments are processed by Stripe — we never see your full card number. If you turn on Connected Activity, a limited daily activity signal — never raw health data.
What we never touch
- Passwords or PINs We do not ask for, transmit, or store login credentials for your outside accounts. There is no field to enter one — by design. (Your Trust Relay sign-in password is held only as a secure hash by our authentication provider.)
- Account balances We do not connect to your accounts, scrape statements, or hold balance information of any kind.
- Banking sessions or tokens No Plaid, no OAuth bank-link, no session credentials. We are pointedly outside the access path.
- Early contact with your people Unless you choose to let them know they were named, your beneficiaries hear nothing from us until verification completes. Nothing is pushed to them prematurely.
Verification, step by step
Nothing is released until each step is complete.
The release of guidance is the only moment when your data leaves the vault. We designed that moment to be slow, careful, and reversible.
-
We check in with you — not them
Yearly, quarterly, or monthly — you choose. We send a short note to confirm your records are current. One click answers it, and simply signing in counts too. Your beneficiaries see nothing during this step.
-
If we don’t hear back, we try harder — still only with you
Reminders follow, spaced over days, each with one-click confirmation. If you stay silent, a person tries to reach you directly using the contact details on your account. Responding — or signing in — stops the process immediately, at any stage.
-
A person reviews the case — never a machine
Whether it starts with a missed check-in or a concern someone reports, a member of our team reviews the case before anything else happens. They see how long you’ve been quiet and what we’ve tried — never what you’ve written or your account numbers. Those stay encrypted until they reach the people you chose. A report about you opens a review, never a release, and we never confirm to anyone whether an account exists.
-
Only after death is confirmed do your beneficiaries hear from us
A person — not an algorithm — approves the release, and a 72-hour final notice goes to you first. Any sign of life cancels it automatically. Only then does each beneficiary receive the guidance you wrote for them — and only theirs. Unless you chose to let them know they were named, nothing reaches them before this point.
You stay in control. Always.
- Edit at any time. Update institutions, beneficiaries, or instructions whenever life changes. Nothing is locked in. Nothing is permanent without your consent.
- Revoke at any time. Remove a beneficiary, or delete the entire vault. The data is deleted; the audit trail of the removal is retained.
- Strong encryption. TLS 1.3 in transit and AES-256 at rest, on infrastructure built to a widely trusted security baseline.
- Sensitive details optional. Account numbers and policy IDs are not required. Many families need only the institution name and a clear instruction in your own words.
- No premature alerts. Notifications are released only after verification completes. Mistaken or premature alerts are prevented by design.
Begin today
Protect your family from confusion and uncertainty.
Set it up once. Stay ready, quietly. We hold the map — never the keys to your accounts.