Trust Center
What your security team can check, and what it cannot yet.
Each line says whether it exists today, the record behind it, and where to read it.
The status board
What exists, what is coming, what is not there.
Every line says whether it exists today and where to read it. Nothing is listed as held until it is.
In place, and you can check it
- Vault content is sealed on the owner’s deviceOne record, four readersThe database holds sealed bytes for a record’s content, outline and figure. The app’s own code sealed a sample record and tried to read it as each party that touches it.
- Advisors read an outline, not recordsHow an advisor is given a keyA type, a title and dates. A figure only if the owner shares that one figure, after checking the advisor’s key.
- Audit events are hash-chained and signedThe log, edited and uneditedA changed or removed event fails the check. A rewrite by someone who holds the signing key would not show.
- Written policiesWhat is on file31 policies, the first effective April 23, 2026, each with an owner. Internal records, not audited.
- Vendor registerThe vendor list20 vendors, with an agreement recorded for 17. No vendor audit report has been collected yet.
- Vulnerability disclosure policysecurity.txtA contact, a commitment to acknowledge a report within 24 hours, and safe harbour for good-faith research. The policy’s own words, not measured.
- Card details stay with StripeWhere each framework standsGuardKin’s own scope determination is PCI DSS SAQ A: card details do not pass through GuardKin’s servers. A self-assessment.
Partly in place
- The operator console reads metadata onlyThe operator’s layersIt selects named columns and has no function that decrypts. A database role that cannot read a sealed column backs 3 of 18 operator routes.
In preparation
- SOC 2 Type IIWhere each framework stands43 criteria mapped and 31 policies written. No auditor, no observation period, no report.
- Independent cryptography reviewWhat this page does not claimScheduled. No firm is engaged and there are no findings.
- Penetration testWhat is on fileA scope document is written. There is no test report.
- A restore drill on productionWhat is on fileA nightly backup is written outside the database host. No drill has been run on production, so the recovery time is untested. One AWS region, no failover.
Not in place
- Escrow and an insured wind-downCommitment 08No source-code escrow, no data custodian, no escrow of key material and no insured wind-down. No agreement for any of them is signed.
- ISO 27001Where each framework standsPlanned after SOC 2. GuardKin holds no certificate.
- Single sign-on for firmsFor firmsNot self-serve. The firm console has no provisioning route for a firm’s identity provider.
- A handover for incapacityEvery limitA handover opens for a death only. For someone who cannot act, a power of attorney is the arrangement.
Questionnaire answers and the full text of the data processing agreement go to named reviewers, under a mutual NDA where needed. There is no download yet: a person handles each request, so that access is scoped and logged. A SOC 2 report and a penetration-test report do not exist yet, so none is held back.
Ask a security questionCommitments
The nine things GuardKin binds itself to.
The Terms bind these. Each is marked as something this site lets you check, a promise about conduct, or not yet in place.
Zero-knowledge for sensitive content.
Credentials, personal letters, specific beneficiary instructions, medical directives — cryptographically invisible to GuardKin, to the client’s firm, and to the advisor. No back doors for law enforcement. No back doors for firm compliance. No back doors for us.
CheckableThe sealed layers of one record, tried by each reader. The recovery cards are the one designed way in that GuardKin does not hold: 3 of the 5, with a copy of the stored data.
One record, four readersClient-owned vault.
The client sets their credentials. The client controls what the advisor sees. The client retains a unilateral right to unlink from the firm. No firm contract, configuration, or administrative action can prevent this.
Partly checkableThe key mechanism is shown; the contract terms are a promise.
How an advisor is given a keyMetadata/content boundary enforced cryptographically.
Not by access policy — by data model. A bug in the advisor dashboard cannot expose content because the server does not have the keys to provide it.
No data sales.
Not in aggregate. Not anonymized. Not to partners, parent institutions, market researchers, or affiliates.
A promiseA commitment about conduct. Nothing on this site can show it.
No conflicted partnerships.
No kickbacks from insurance, investment, or financial-product providers based on what GuardKin surfaces.
A promiseA commitment about conduct.
No crisis-mode upselling.
A user actively navigating a death is not a revenue opportunity.
A promiseA commitment about conduct.
Export guarantees.
User data is portable at any time regardless of subscription status or firm relationship.
A promiseExport has not been tested end to end.
Company-survival provisions.
Not yet in place. GuardKin has no source-code escrow, no separate custodian for encrypted data, no escrow of key material and no insured wind-down, and has signed no agreement for any of them. GuardKin does not hold your Master Password or your Secret Key.
Not in placeThe published text of this commitment described arrangements that do not exist.
Published client code within 2 years of public launch.
Independent parties can verify what the client application does with sensitive content.
A promiseFalls due after launch. Nothing is published yet.
Questionnaire
Answers to what a security review asks.
Short answers, each with the record it rests on. Where the answer is “not yet”, it says so.
- Where is data stored?
- In the United States. The database is on Neon and the application runs on Railway. Keys, documents and backups are on AWS in a single region, us-east-1, with no cross-region copy or failover. GuardKin does not offer EU or UK data residency today.
- Basis: System description; vendor register; the data processing agreement. The vendor list
- Is data encrypted in transit?
- Yes, over TLS. The system description commits to TLS 1.2 or later.
- Basis: Written in the system description. GuardKin has not published a scan of its endpoints.
- Is data encrypted at rest?
- Vault content, outlines and figures are sealed on the owner’s device with AES-256-GCM before they reach us. Columns the service must read, such as email addresses, are encrypted under a key GuardKin holds. That key can read those columns and cannot open vault content.
- Basis: The record on the Security page; the key-model document. One record, four readers
- Who can read vault content?
- The owner. After a death, an executor can read the records the owner released, on the executor’s own device. Three recovery-card holders acting together can rebuild the owner’s keys. Alone they cannot read anything, because GuardKin gives them no data. With a copy of the stored data they can read everything, which is why the owner chooses them.
- Basis: The executor hand-off in the cryptographic protocol; the recovery cards in packages/crypto. Recovery and release
- If GuardKin’s database is breached or a backup leaks, can the thief read my records?
- A stolen database, a leaked backup or a court order for our servers yields your records only as locked bytes, and nothing GuardKin holds unlocks them. The keys are yours, and three of your five recovery cards rebuild them. The cards are a deliberate exception: an owner who loses everything still needs a way back. Three card holders alone cannot read your records, because GuardKin gives them none of your data. Three card holders and a copy of the stored data, such as a database dump or a backup, can read all of them. Choose the five with that in mind.
- Basis: The recovery cards in packages/crypto, run against the real functions; the routes in apps/api that serve ciphertext. Recovery and release
- What can an advisor or a firm see?
- With the owner’s consent, an advisor sees the outline of each record: its type and title, and its dates. The owner can hide a title. A figure reaches an advisor only if the owner shares that one figure.
- Basis: The advisor’s read of the sample record, run by the app’s own code. One record, four readers
- What can GuardKin staff see?
- The operator console shows counts, types, states and dates. It selects named columns and has no function that decrypts. A database role that cannot read any sealed column backs 3 of 18 operator routes today. Operator sessions require a second factor.
- Basis: Migration 0020; the operator wall ledger in apps/api. The operator’s columns
- What if GuardKin stops operating?
- Nothing is arranged. There is no escrow of source code or keys, no separate custodian for encrypted data, and no insured wind-down, and no agreement for any of them has been signed. GuardKin does not hold your Master Password or Secret Key, so it cannot open your records.
- Basis: The business continuity policy; the continuity contacts record.
- Does GuardKin use AI on customer data?
- The assistant feature is hidden in the product while its purpose is decided. GuardKin’s agreement with its language-model vendor is a zero-retention one.
- Basis: The vendor register. The vendor list
Found something? Tell us first.
A published policy gives a contact, an acknowledgement target and safe harbour for good-faith research.