Security at HeirLatch

Account passwords, letter text, device passcodes, two-factor numbers and document access instructions are encrypted with AES-256-GCM before they leave your device. Your master password is never transmitted or stored. The inventory around those secrets — who your contacts are, which accounts you hold, where your documents are — is not encrypted, because the service acts on it. Our privacy policy lists exactly which fields those are.

The encrypted fields are decryptable only with the key derived from your master password, which we never receive. If you set up key escrow or distribute recovery shares, the people you nominated can jointly recover that key after the waiting period — that is the point of those features, and neither works unless you enable it.

Hosted on SOC 2 Type II certified infrastructure (AWS, via Supabase and Vercel). HeirLatch's own SOC 2 audit is planned.

Actions that are successfully recorded land in a hash-chained audit log. Every export publishes the canonical input format and the chain verification result, so a recipient can re-derive the chain and see any break reported. Exports are signed with Ed25519 and verifiable by anyone holding our published public key, which we serve as a public key set that keeps retired keys so an old export still verifies. We say plainly what that anchor is worth: a key fetched from us proves only that whoever controls the endpoint controls the signature, and the stronger check is the same key appearing unchanged over time. An export produced while no signing key is configured says so explicitly and carries no signature at all.