You're trusting us with your most sensitive files. Here's how we protect them.
Your files are encrypted
Everything is encrypted in your browser before it reaches us. Your files are encrypted on your device using keys derived from your password. Unencrypted files never touch our servers—not even temporarily. Encryption happens in your browser before upload; decryption happens in the browser after download.
- In-browser encryption: files are encrypted before they leave your device
- Encrypted storage: everything stored on our servers is encrypted
- No master key: each vault has its own unique release key—there's no single key that unlocks everything
- Two levels of protection: Standard mode (we hold a per-vault release key but don't access files) or Maximum Privacy (we literally cannot decrypt)
Two encryption modes
Standard Protection (all plans): We hold a release key for your vault (stored encrypted, separate from your data) that can unlock it for your contacts after the escalation process completes. Each vault has its own unique key—there's no master key. This means we could technically decrypt your files—but we don't. Our access controls, audit logging, and policies prevent it. And even then, unencrypted files never exist on our servers: decryption always happens in the browser. The trade-off: simpler experience for your contacts, who just click a link to access released files.
Maximum Privacy (Plus plan): True zero-knowledge encryption. No release key exists on our servers. Only you hold the decryption key. File names are encrypted too—we can't see them. After release, your contacts need a passphrase that you've shared with them separately (in a safe, a letter, or with a solicitor). You can leave them a personal message (which might hint at where to find the passphrase), but we cannot decrypt the contents or see file names. Not "won't"—can't.
EU data residency
- All data stored in the EU
- No US cloud providers (no AWS, Google Cloud, or Azure)
- GDPR compliant by design
- Subject to EU privacy laws
No accidental releases
False positives are what we work hardest to prevent. We've built multiple safeguards:
- Long escalation timeline (~40+ days from first missed check-in)
- Multiple checkpoints before release
- Multi-channel outreach (email + SMS + WhatsApp)
- Contact verification before release
- Final warning sent 2 days before release
You can always respond at any stage to stop the process.
Multi-channel reliability
We don't rely on a single method to reach you:
- Email to your registered address
- SMS to your phone number
- WhatsApp if you've enabled it
If one channel fails, others continue. This redundancy reduces false positives.
What we don't do
- We don't sell your data
- We don't show ads
- We don't share information with third parties (except for delivery—email/SMS providers)
- We don't store unencrypted files
Built to last
We know this concern: "Will this service outlive me?" It's the most important question for a dead man's switch.
Our commitment:
- Sustainable business model: no venture capital pressure, no growth-at-all-costs. We charge enough to run a reliable service indefinitely.
- EU-incorporated: subject to EU business continuity regulations
- Minimal operational costs: designed to run lean, even with a small user base
If we ever shut down:
- Minimum 12 months advance notice
- All users receive encrypted data exports
- Your contacts are notified with instructions
- We'll provide tools to decrypt your files locally
- Your data remains yours—encrypted and exportable
Questions about security? Contact us at security@trustbourne.com