Gentle Handover encrypts most of what you store with AES-256-GCM, holds the keys itself, and says plainly where the protection ends.
How we know this is true
Each line here says what the service does today, and we checked every one against how it really works. The privacy policy lists what is kept without our own encryption.
We hold the keys, so we are trusted with what you store. Here is why we built it this way, and what stands between your data and anyone's eyes.
If only your phone held the key, the people you love would inherit locked boxes that nobody could ever open. We keep the keys on our servers so your letters reach them when the time comes, even without your password, and so a forgotten password does not erase everything you saved.
What you keep in your boxes is stored encrypted with AES-256-GCM. That includes the titles of your items, the text of your letters and plans, and your recordings. Some names stay readable, such as box names, file names, the names of your contacts and the titles of letters, stories and recipes. The privacy policy lists them all. Every key in our database is locked too, so a copy of the database on its own cannot open what is in your boxes.
What is kept without this encryptionOur team's tools have no page that shows what is inside your boxes, and they cannot sign in as you. If someone asks our support team to change your email address, the change waits 48 hours and we tell your old address at once. You can stop it from the link in that email, unless it is an address you told us was not yours. When the change does happen, every device is signed out. Our code also has a check that fails if new code reaches our keys or decryption directly without a reviewed reason.
Every change to your plan and every sensitive step our staff take goes into a sealed record of who did what and when. We check that record every night.
A missed check-in alone releases nothing. First we try to reach you, and then we ask the people you chose. A death must be confirmed by those people, or by a person on our team who signs in with a passkey and proves who they are again for that one decision. Then we wait at least 48 hours, and your password stops it.
Pausing your check-ins, removing or suspending someone who confirms, and taking an item away from a person all ask for your password.
Download a copy of what you stored whenever you want. Your files come in a ZIP file locked with a password you choose, and a very large recording or file may be listed instead of included.
The basics, done carefully.
A missed check-in alone releases nothing. Two of your trusted verifiers, or a person on our team, must first confirm the death, and then we wait. By default, crypto wallet details, passwords and account logins also wait until a person on our team has read a death certificate. If none can be found, they open after a longer wait.
Built with European privacy law in mind, with a sealed record of sign ins, security changes and every step of a handover. We check it every night.
Export everything whenever you want, or make a Continuity kit that opens without us.
Email alone can land in spam. So when it matters, we try one way at a time, and stop the moment we hear back.
We use only the ways you set up, in the order you choose. Your settings show which ways are available for your account.
We wait between steps and never send everything at once. Checking in, tapping "I am OK", signing in or replying OK ends every message still waiting. A sign in does not count if someone you trust has told us you died and nobody has confirmed it yet.
Every message we send to reach you says only who we are and gives one link. What you keep here is only ever opened on our site, by the right person.
Before a reported death goes ahead, we must have tried at least two different ways of reaching you. If email is all we have, a person from our team tries you and the people who confirm for you. If no answer is recorded within 7 days, the case goes ahead, but still only after the confirmations and the wait.
On ordinary days you get one gentle reminder, on the first way you chose. Nights stay quiet. If it ever feels like too much, one tap on "Too many messages?" makes it less.
Why this section exists
People worry that a missed email could send their things out too early. Each card says what really has to happen first, in the order it happens.
A handover should never happen by mistake. These rules hold for every account, and each one is how the service works.
Before anything is released
A missed check-in only starts the asking. What you keep for after your death is released only once two of your trusted verifiers, or a person on our team, confirm the death. One verifier alone is never enough, so then a person on our team must confirm too. Only a few urgent wishes, such as your funeral wishes, can open sooner. That happens only if someone you allowed reports your death and you do not answer in time.
After a death is confirmed, nothing goes out for at least 48 hours, however it was confirmed. Halfway through, we remind you again on every way that is set up for you.
Confirm with your password at any moment during the wait and the case is cancelled. If someone you trusted says you are alive, everything pauses until a person on our team looks at it.
When something goes wrong
Before a case moves forward, at least two different ways of reaching you must have been tried since you last checked in. If email is all we have, a person from our team tries you and the people who confirm for you. If no answer is recorded within 7 days, the case goes on, still only after the confirmations and the wait. This cannot be switched off.
While our service is interrupted, no case can start and nothing is released. Afterwards, your check-in date and any wait that was running are moved later by the time we lost.
Each delivery goes out once, never twice by accident. If a send fails, we try again rather than lose it, and our team is told if it keeps failing.
For readers who want the exact methods
A small setup, described as it really is.
The service runs in AWS's Frankfurt region. The application runs on one server, and the database and the cache that holds the job queues are separate managed services in the same region. Nothing runs in a second region. If the application server goes down, the service is down until it is back.
Every request reaches Cloudflare first. It handles the encrypted connection, blocks attacks and limits repeated attempts, then passes the request to our server through a tunnel the server opens itself, so the server has no open port facing the internet. The application runs in Frankfurt, so someone far from it may notice the distance. From elsewhere we load a typeface, the Paddle checkout on the payment pages and, where it is switched on, the Cloudflare bot check on the sign-in and sign-up forms.
The database keeps automatic backups for 35 days, and a copy of them is kept in AWS's Ireland region. The server's disk is copied every day, and each copy goes to Ireland as well. Before every update an encrypted copy of the database is taken and kept for 30 days.
There is no formal, documented schedule for testing a recovery, as our data processing agreement says.
We fix it by hand. A check every five minutes alerts us when the schedule stops or a release is stuck. Nothing promises how fast the fix comes, so we publish no availability figure, and you should not assume one.
What you can do with your own data from your account, what our staff can see, and where to write about security or privacy. The status page shows what our own checks see right now.
What protects your data, and the limits we want you to know.
Download a readable copy of what you saved and your account records, or a copy locked with a password you choose. Only the locked copy carries the files you uploaded, and other people's private details stay out. The file is deleted after 48 hours.
Export your data, read your activity log, or close your account. Closing waits 30 days so you can change your mind.
Our staff see only what their role allows. You can protect your account with an authenticator app, security keys and passkeys.
Your check-ins and security changes, such as a new password, two-step sign-in or passkeys, go into an activity log you can read in your settings. We are a small company, not a round-the-clock security operations center.
We do not publish an uptime figure we cannot prove. The status page shows what our own checks see, the ways we can reach people, and what is switched off.
View full status pageEvery address and number we write from, what we never ask for, and how to check.
Write to us with a privacy question, a request about your data, or to ask for a data processing agreement.
[email protected]A hardware security key, such as a YubiKey or any FIDO2 device, makes phishing much harder, because it only answers to the real site.
A security key answers only to our real site, so a fake page cannot use it.
If you find a vulnerability, tell us and a person will read it. There is no paid bounty program. We would rather say so than advertise a reward we have not budgeted.
Reports of a weakness are welcome
Ask us anything about how this works, and a person will answer. There is no outside audit report or penetration test summary to send.
Each standard and service this page names, linked to the body that publishes it.
Start with one letter. It is free.
No AI reads your question. The box looks for its words in the answers our team wrote and in our help articles, and shows the closest ones. A question it cannot answer is kept for 30 days, without your name, address or any cookie, so we can write the missing answer.
Answers from our help pages
We do not ask who you are. A question we cannot answer is kept for 30 days without your name or address, so we can write the answer.
Not what you needed?
A person reads every message and answers by email.
We have no written answer for that
Try other words, or write to us. A person reads every message.
Talk to a personPlease add a few more words
A whole question finds a better answer than one word.