Is 'When I Die' secure?

The data that will be stored in the 'When I Die' app is personal and often sensitive information that no other eyes should see other than the ones you intended it for.

To provide this layer of security:

• Two-factor authentication (2FA) will be required for every account. It combines your password with a time-based one-time code from an authentication app. You turn it on for your own account.
• Encrypted sensitive values Passwords, PINs, security answers, backup codes, account numbers and notes are encrypted by the app before they are stored, so they cannot be read from the database itself.
• Anti‑Forgery Tokens All communication with the server is protected by anti‑forgery tokens, which help ensure that requests cannot be altered or impersonated.
• Encrypted Transport Data sent between your device and the server is encrypted using secure transport protocols.
• Strong sign-in Passwords need at least 12 characters with upper and lower case, a number and a symbol. After five wrong attempts an account is locked for 15 minutes, and you are signed out after 30 minutes without activity.
• Encrypted uploads Documents, pictures and videos are encrypted as soon as the server receives them and are stored encrypted, outside the website's public files. They are decrypted only for a person who is allowed to open them.
• Role-based access Each role only gets the pages and data it is meant for, and the server enforces this as well as the menu. Executors, trustees and beneficiaries get access only after the owner is recorded as deceased, and a beneficiary never sees passwords.
• Access log Viewing sensitive values and other important actions are recorded. You can review them under Administration > Access log.
• Shown only when you ask A sensitive value is decrypted on the server and sent to your browser only when you ask to see it. Every view is recorded in the access log.