Trust center

How we keep this safe

You're trusting us with your wishes, your evidence, and your goodbye. The posture below is non-negotiable — the engineering exists to back it up.

Encryption

TLS in transit, AES-256 at rest. MFA secrets and recovery codes are encrypted at the field level on top of disk encryption.

Role-based access

Owner, Executor, Delegate, Recipient, Professional. Each role sees only what their role allows. Audience tags (private, executor-visible, family-facing) gate every module and document.

Audit logs

Every change, download, share, release action, and admin operation is logged with actor, timestamp, IP, and target. Owners can read their own audit. Admins can read break-glass logs only — never the content of private modules.

Signed-URL downloads

No object is ever served from a static URL. Every download is a fresh signed URL with a short expiry, and every view is recorded.

Release gating

Nothing in your plan releases automatically without the conditions you set: date triggers, inactivity windows, executor confirmation, optional second verifier, optional staged rollout. You can pause or cancel any release at any time.

Legacy AI safety

Legacy AI is a simulation built from materials you provide. It is labeled as such on every screen. It cites its sources. It has a kill switch. It is never sold, marketed, or framed as the return of a loved one.

Account deletion

You can export everything. You can delete everything. Deletion is a multi-step pipeline that purges database rows, object storage, vector indexes, and backups within the retention window — and we send you a receipt.

Soft limits

Free trials get full features but server-side soft caps prevent abuse. Real users won't hit them. Bots will.

A clear note on Legacy AI

Legacy AI is a simulation built from your provided materials. It is not your loved one. It is not supernatural. It is not "them returning." It cites the words and documents it was given, it has a kill switch, and the people who chat with it see a "Legacy Simulation" label and a report button on every message. We will never market it otherwise.