Security architecture
Encryption model
Vault content is encrypted with AES-256-GCM before it is stored. Each user has a unique 256-bit vault key. That key is itself encrypted with a server-held master key (environment variable) using AES-256-GCM.
This is server-side encryption. Ever Legacy can decrypt data when needed to operate the service — when you log in, and when assigned assets must be delivered to beneficiaries after a Heartbeat trigger. We do not read vault contents for advertising.
Account access is restored with a password reset. You do not hold a separate encryption key that we cannot recover.
Account security
Passwords are hashed with bcrypt (cost factor 12) and never stored in plaintext. Sessions are authenticated over HTTPS/TLS.
Optional authenticator 2FA (TOTP) is available in account settings after signup. We recommend enabling it, especially if you store passwords or crypto instructions.
Beneficiary verification
After a trigger, each beneficiary receives a unique email link to only the assets you assigned. Links expire (typically one year). Beneficiaries do not need an Ever Legacy account.
What this is not: we do not currently run government ID verification or a second factor for the beneficiary. Anyone with the link can open the assigned assets until expiry. Choose beneficiaries and email addresses carefully.
Heartbeat failure protection
Heartbeat check-ins are sent by email. If you miss a check-in, we send reminders during a grace period you configure (30–180 days). Access is not released until that period ends without confirmation.
If you were traveling or the email was delayed, confirm the Heartbeat (or sign in) to cancel a false trigger before the grace period ends. We do not currently send SMS or push Heartbeat messages.
Infrastructure, backups, retention
Ever Legacy runs on professionally managed cloud infrastructure. Database connections use TLS. Production access is limited to a small authorized team. Hosting region and provider names are available on request at support@everlegacy.app.
You can export your data and delete your account from settings. Account deletion removes associated vault data (subject to short processing windows and any legally required records). Payment processing is handled by Stripe.
What we don't do
We don't read your vault for ads
We don't analyze vault contents for advertising or sell that data.
We don't sell your data
Personal data is used to run the service, not for ad networks.
Limitations and transparency
- Not zero-knowledge: the server has the master key and can decrypt vault data to operate login and beneficiary delivery.
- Not "bank-level": we do not use Hardware Security Modules (HSM) or hold PCI-DSS or HIPAA certifications.
- Not end-to-end encrypted: the server mediates encryption and decryption so assigned assets can be delivered after a trigger.
- Not a legal will: Ever Legacy complements an estate plan; it does not replace legal documents or advice.
- Compliance: we do not currently hold SOC 2, PCI-DSS, or HIPAA.
Security contact
Report a vulnerability or ask about subprocessors, backups, or incident response at support@everlegacy.app. Please do not include live secrets in email.