Trust needs specifics.

Here is what exists in the private build, what it means, and what is still being developed.

Current private-build safeguards

• Vault content and attachments are encrypted on the server using AES-GCM.
• Two-factor authentication and account-scoped authorization checks are implemented.
• Structured account activity records capture important changes.
• Vault lists use summaries; individual contents are decrypted when opened.

Encryption boundaries

This is server-side encryption. The application server can decrypt content using its configured keys. Digital Keep does not currently offer end-to-end or zero-knowledge encryption. Security depends on account protections, application controls and correct operational key management.

Before legacy release goes live

Operational beneficiary and death verification, reviewer permissions and release procedures are still being developed. Invitation acceptance does not verify someone’s identity or a death. Death reports and legacy delivery are not active public services, and there are no government death-registry integrations.

The public waitlist

The marketing site is deployed separately from the private application. Its server validates submissions, limits request size and rate, and stores signup details in a dedicated database. Database credentials stay on the server. The waitlist is not a place to store sensitive legacy information.

Security reports

Contact contact@digital-keep.com with a description of a potential issue. Please omit secrets and other people’s personal data. No independent security certification or formal response-time commitment is claimed.