Skip to main content
HeirLatch LogoHeirLatchBack to Home

Security at HeirLatch

Your trust is our priority. We employ industry-leading security measures to protect your most sensitive information.

End-to-End Encryption
All sensitive data is encrypted using AES-256-GCM encryption before it leaves your device. Your master password is never transmitted or stored.
Zero-Knowledge Architecture
We cannot access your encrypted data. Only you and your designated trusted contacts can decrypt your information with the proper keys.
Secure Infrastructure
Hosted on SOC 2 Type II certified infrastructure (AWS, via Supabase and Vercel). HeirLatch's own SOC 2 audit is planned.
Tamper-evident audit log
Actions that are successfully recorded land in a hash-chained audit log. Every export publishes the canonical input format and the chain verification result, so a recipient can re-derive the chain and see any break reported. Exports are signed with Ed25519 and verifiable by anyone holding our published public key — which we publish in two independent places, because a key fetched from us alone proves less than the same key appearing consistently over time. An export produced while no signing key is configured says so explicitly and carries no signature at all.

Technical Security Details

Data Encryption

  • AES-256-GCM encryption for all stored sensitive data
  • PBKDF2 with 100,000+ iterations for key derivation
  • Unique encryption keys per user, derived from master password
  • TLS 1.3 for all data in transit
  • Perfect forward secrecy on all connections

Authentication Security

  • Account sign-in is handled by Supabase Auth — HeirLatch never stores your account password
  • Optional two-factor authentication (TOTP)
  • Session tokens with automatic expiration
  • Brute-force protection and rate limiting
  • Check-in anomaly detection on your HeartBeat schedule

Compliance & Certifications

  • GDPR compliant data processing and storage
  • CCPA compliant for California residents
  • Hosted on SOC 2 Type II certified infrastructure (AWS, via Supabase and Vercel). HeirLatch has not itself been audited against SOC 2; that audit is planned
  • Primary data, backups and application logs are stored in the EU (Frankfurt). Sub-processors listed in our DPA may process limited data elsewhere — email delivery and payments among them

Operational Security

  • Row-level security on every table, enforced by the database
  • Hash-chained audit logging of security-relevant actions
  • Rate limiting and CSRF protection on state-changing routes
  • Admin actions gated by role capabilities and an IP allowlist
Security Vulnerability Reporting
Help us keep HeirLatch secure

We appreciate the security research community's efforts in helping us maintain a secure platform. If you discover a security vulnerability, please report it responsibly.

Report vulnerabilities to:

security@heirlatch.com

We will acknowledge receipt within 24 hours and work with you to understand and resolve the issue.