Your Family's Data. Bank-Level Security.

• AES-256-GCM encryption for sensitive fields including account numbers and secure access notes
• TLS 1.3 encryption for all data in transit
• All data encrypted at rest in our database
• Private storage buckets with time-limited signed URLs for documents and media files

• Multi-factor authentication (TOTP) enforced for all accounts
• Role-based access control: Owner, Spouse, Executor, and Point Person each see only what they should
• Granular sharing controls — choose exactly what each family member sees
• Automatic session management with secure, httpOnly cookies
• Rate-limited login to protect against brute-force attacks

• Hosted on Vercel (SOC 2 Type II compliant)
• Database on Supabase (SOC 2 Type II compliant, built on AWS)
• Row Level Security on every table — enforced at the database level, not just the application
• No single point of access — even our own team cannot see your encrypted data without your key
• Payments processed by Stripe (PCI DSS Level 1)

• Content Security Policy (CSP) to prevent cross-site scripting
• HTTP Strict Transport Security (HSTS) to enforce encrypted connections
• X-Frame-Options: DENY to prevent clickjacking
• X-Content-Type-Options: nosniff to prevent MIME-type sniffing
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy restricting camera and microphone access

• We never sell your data
• We never share individual data with third parties
• You can export all your data at any time
• You can delete your account and all data at any time
• Compliant with CCPA (California Consumer Privacy Act)
• Working toward SOC 2 Type II certification

• All code changes reviewed before deployment
• Automated vulnerability scanning on every build
• Schema validation on every form submission, both client and server side
• Input sanitization to prevent injection attacks
• Regular security audits

If your compliance team has questions, we're happy to provide our Security Evidence Pack, discuss our architecture, or schedule a technical review. Contact security@nextofkinplan.com.