LegalSecurity
Security
LifeKeel holds information about your family's finances and documents, so it is built to keep that information private by default. This page covers how it is protected, what you can do to keep your account safe, and how to report a problem.
How your data is protected
Encrypted in transit
Every connection to LifeKeel uses HTTPS (TLS).
Encrypted at rest
Passwords are stored only as salted hashes. Email credentials, connector tokens and vault documents are encrypted before storage, and vault documents can also be sealed in your browser.
Households kept apart
Each household’s data is separated by account, so one family cannot see another’s.
Read-only connections
Connected mail is read-only: LifeKeel cannot send, change or delete your email.
Sign-in protection
Sign-in attempts are rate-limited, two-factor authentication is available, and sign-in history is kept for 30 days to help investigate unusual activity.
Careful with logs
Error logs have tokens and personal details removed before they are stored.
No system is perfectly secure. If a breach puts you at high risk, we will tell you without undue delay. The AI providers that may process your documents are listed on our Trust page.
Keeping your account safe
- Turn on two-factor authentication in Settings.
- Use a password you do not use anywhere else; a password manager makes this easy.
- Never share your password, two-factor codes or recovery codes with anyone, including someone who says they are from LifeKeel.
- Sign out on shared devices, and contact us if you see activity you do not recognise.
Reporting a security problem
If you think you have found a weakness in LifeKeel, please tell us before sharing it publicly. We will read every report.
Include what you found, how to reproduce it, and how to reach you. Please do not access other people’s data, and do not run tests that could disrupt the service.
Report to
Testing in scope
- In scope: the LifeKeel web app, its API, and the public website.
- Use only accounts you created yourself, and stop as soon as you reach anyone else's data.
- Out of scope: denial-of-service or load testing, social engineering or phishing of staff or users, physical attacks, and automated scanning that degrades the service.
- Out of scope: reports about third-party services we do not control, unless LifeKeel's use of them causes the issue.
Disclosure
Please give us reasonable time to investigate and fix an issue before sharing it publicly, and keep any data you came across confidential.
The same contact is published in machine-readable form at /.well-known/security.txt.