Testamently only ever holds one half of the lock — a code, a location, a pointer. The other half — the phone, the wallet, the safe — lives in your home and is never uploaded. So what you store is safe even from us.
Security isn’t a promise — it’s the shape of the product. Because we only keep the half that’s useless on its own, a full database breach exposes nothing usable. And everything is still encrypted in your browser before it reaches us, up to a zero-knowledge tier that even we can never read.
Not your everyday logins — the half that’s useless on its own, but priceless to the people you leave it to.
Every secret is encrypted client-side using AES-256-GCM with a random 96-bit IV. We store only ciphertext, so even if our database is breached, your data is unreadable.
Choose a level for each secret. Regular uses your vault key for instant access. Premium adds a master password run through 600,000 PBKDF2 iterations. Gold uses Argon2id (64 MB, memory-hard) — roughly 1,000× costlier to brute-force.
For your most sensitive secrets, the value is encrypted in your browser and wrapped only to your chosen trustees' keys — never to us and never back to you. It is write-only: only your trustees can ever decrypt it, and only after the trigger. A database breach reveals nothing.
Files are encrypted in your browser before upload. Each file gets a unique encryption key, which is itself wrapped with your vault key. The encrypted buffer is uploaded to Supabase Storage. Decryption happens entirely in your browser on download.
After the trigger, your trustees sign in from any device — years later — with just their own login. No hardware key, QR code, or browser file to lose. Access is gated by PostgreSQL row-level security, and protected-tier secrets carry a per-trustee wrapped key so only assigned trustees can open them.
Accounts can be protected with TOTP two-factor authentication from any authenticator app. When enabled, it is enforced at sign-in (AAL2) before the vault can be reached.
Uploaded death certificates are stored in a private Supabase Storage bucket with row-level security. Only admins can access them for review. Files are never publicly reachable.
Every database table has RLS enforced at the PostgreSQL level. Your rows are invisible to any other user — even with a valid session token.
All traffic is encrypted in transit with TLS 1.3. HTTPS is enforced with HSTS headers. No plain-HTTP fallback.
60 requests per minute per IP on all API routes. Auth endpoints have stricter limits to prevent brute-force attacks.
Admin operations use a service-role key held server-side only — never exposed to the browser. Admin reads never return encrypted payloads.
All admin actions (trigger vaults, approve certificates, change tiers) are logged with actor, timestamp, and target.
Account deletion triggers a hard purge of all secrets, files, and trustee data from the database and storage.
Read the source, or reach out directly.