Security & Trust
How we protect your data, in plain English.
We hold passwords, medical directives, and family secrets. We owe you specifics, not slogans. Here is exactly what we do, what we don't do yet, and how to reach us about security.
In plain words
- Your vault passwords are locked with your master password on your own device. We cannot open them. Only someone you give that password to can.
- Your asset list, will draft and uploaded documents are stored encrypted by our cloud providers, mainly in Singapore. Our systems can read them so they can be shown to you and the family you choose. We do not browse them.
- If you stop paying, your account moves to the Free plan. Nothing you saved is deleted.
- You can download a copy of all your data from Settings at any time, and delete your account there too.
Technical summary
- Your password vault is encrypted on your device with AES-256-GCM before it ever reaches our servers (zero-knowledge, we cannot decrypt it).
- All traffic uses TLS 1.2 or higher in transit.
- Other data lives in Supabase Postgres with encryption at rest, row-level security, and role-based access controls.
- Authenticator-app (TOTP) two-factor authentication is available, with backup codes hashed with SHA-256 server-side.
- We have not completed a SOC 2 or ISO 27001 audit yet. We will publish a Trust Centre with reports the moment we do.
Detailed matrix
| Data type | At rest | In transit | Can Sort My Legacy read it? |
|---|---|---|---|
| Passwords and other vault entries | AES-256-GCM, key derived from your master password via PBKDF2 (310,000 iterations) on your device | TLS 1.2+ | No, zero-knowledge |
| Financial inventory, will draft, family roster | Supabase Postgres at-rest encryption (cloud-provider-managed keys) | TLS 1.2+ | Yes, under strict access controls; only used to deliver the product or comply with a lawful request |
| Uploaded documents (PDFs, scans, photos) | Supabase Storage at-rest encryption + per-user access policies | TLS 1.2+ | Yes, technically. We don't browse them. |
| Backup codes (for 2FA recovery) | SHA-256 hashed before storage | TLS 1.2+ | No |
Two-factor authentication
Set up TOTP via Google Authenticator, 1Password, Authy, or any standard authenticator app. We generate 10 backup codes at setup so you never get locked out. Backup codes are SHA-256 hashed server-side; we don't store them in clear.
HTTP security posture
HSTS preload (Strict-Transport-Security with includeSubDomains; preload)X-Frame-Options: DENY (clickjacking protection)X-Content-Type-Options: nosniffReferrer-Policy: strict-origin-when-cross-originPermissions-Policy: camera, microphone, geolocation all locked offCross-Origin-Opener-Policy: same-origin-allow-popups (required for Google OAuth)
Verify any of the above by inspecting response headers with curl -I, or via Mozilla Observatory.
Compliance posture
DPDPA (India's Digital Personal Data Protection Act 2023): we follow the principles, purpose limitation, minimisation, retention, breach notification, and our Privacy Policy spells them out. SOC 2 Type II and ISO 27001 are on the roadmap; we will not claim them until they are completed and the reports are public.
Sub-processors
We list every third party that touches your data and what they touch.
- Supabase (database and file storage), Singapore region
- Vercel (hosting, edge), global
- Firebase Authentication (email, phone OTP, Google sign-in; Apple sign-in on iPhone), Google Cloud
- Zoho ZeptoMail and Resend (transactional email), Zoho Mail (support inbox)
- Razorpay (payments), Indian payment processor
- Meta, WhatsApp Business Cloud API (notifications)
- Sentry (error reports, set up not to send personal details)
- Google Analytics (only if you accept analytics cookies) and Vercel Web Analytics and Speed Insights (cookie-free page statistics)
- Apple and Google (App Store and Google Play purchases, and push notifications)
Responsible disclosure
Found a security issue? Email hello@sortmylegacy.com. We look into every report and fix confirmed issues as a priority.
