You hold the keys. All of them.
Constellation is built so that nothing opens without your say, and so that every hand which could reach your data is named, narrow, and on the record — with the parts we haven’t finished included.
in force
- AES-256-GCM encryption
- Least-privilege access
- Per-request authorization
- Immutable audit log
- TLS 1.3 in transit
What stops someone from triggering access?
A clock, and a veto that belongs to you. Activation is a request that runs on a timer you set, and you can stop it at any point before it completes.
Five things holding that door
- The code lives offlineActivation needs the Estate Card code. It isn't emailed, isn't in your account, and can't be recovered by support — which is exactly why it works.
- You are always toldEmail and SMS on every attempt, successful or not. There is no quiet path through this system.
- Attempts are rate-limitedRepeated failures lock the activation pathway and alert you. Guessing a two-word code is not a strategy.
- The log can't be editedAppend-only database triggers. Attempts, cancellations and access events cannot be quietly rewritten — by anyone, including us.
- Death verification is your callWe don't route this through a third-party data broker — those feeds are slow, leaky, and wrong often enough to matter. Want a death certificate required before activation completes? That's a toggle you own. Prefer to rely on the clock and your veto? Leave it off.
You hold the keys. All of them.
Constellation is built so that nothing opens without your say, and so that every hand which could reach your data is named, narrow, and on the record. Here is exactly how, in plain terms, with the parts we haven’t finished included.
What stops someone from triggering access?
A clock, and a veto that belongs to you. Activation is not a switch someone else can flip — it’s a request that runs on a timer you control, and you can kill it from any device until the moment it expires.
Someone asks. Nothing more.
Your executor enters the code from your Estate Card — WORD-NNNN-WORD, two words and four digits, chosen to survive being written on a card by hand and read back over the phone. Held only by you and them. Without the card, there is no request to make.
Activation needs the Estate Card code. It isn't emailed, isn't in your account, and can't be recovered by support — which is exactly why it works.
Email and SMS on every attempt, successful or not. There is no quiet path through this system.
Repeated failures lock the activation pathway and alert you. Guessing a two-word code is not a strategy.
Append-only database triggers. Attempts, cancellations and access events cannot be quietly rewritten — by anyone, including us.
We don't route this through a third-party data broker — those feeds are slow, leaky, and wrong often enough to matter. Want a death certificate required before activation completes? That's a toggle you own. Prefer to rely on the clock and your veto? Leave it off.
Every document gets its own key
No single key opens the vault, because there isn’t one. Each item is encrypted with a key of its own, and that key is itself wrapped by a master key held in hardware — envelope encryption. Break into one item and you have exactly one item, not a library.
Held in an AWS KMS hardware security module — never in our database, never in our application, never on a disk we own. Nothing is stored in plaintext: not in the database, not in the logs, not in the backups.
- Document vault encryption
- AES-256-GCM
- Key architecture
- Envelope encryption
- Master key custody
- AWS KMS
- Per-item keys
- Unique per item
- Transport security
- TLS 1.3
- Identity provider
- Clerk (JWT)
- Hash algorithm
- SHA-256
- Database security
- Encrypted at rest (AWS KMS)
- Token generation
- crypto.getRandomValues
- Session validation
- Per-request JWT verify
If you cancel, encrypted data is destroyed with its keys. Ciphertext without a key isn’t recoverable — not by us, not by anyone who buys us.
A very short list of people, and a log none of them can edit
Someone has to be able to restore a lost account or answer a subpoena, so we won’t pretend no one at Constellation can ever reach your data. What we can tell you is exactly how narrow that path is, and that walking it leaves a permanent mark.
Not a role you can be granted, not a checkbox in an admin panel — a named list of user IDs held in AWS Secrets Manager. Adding someone is a deliberate infrastructure change, not a click.
A separate append-only log captures each write an administrator makes: what they did, to whom, and when. It has no delete path and no retention window — those records outlive the people in them.
Each API request is scoped to the account that made it — ask for someone else’s record and you get nothing back. Because that rule lives in code, we don’t take it on faith: an automated suite calls our routes as a user who owns nothing and fails the build if any of them answers with data.
Document keys are unwrapped inside an AWS KMS hardware security module, one call at a time. The key itself cannot be exported, copied, or read — not by us, not by AWS staff.
Vault events land in the Account Activity you can read and export yourself. You are not taking our word for what happened to your documents; you are reading the same record we are.
Plenty of products in this category claim “zero-knowledge.” For most of them, ours included, it isn’t literally true — the servers hold the keys they’d need. We’d rather describe the control that actually protects you than borrow a word that sounds stronger.
Nobody gets the whole thing
Access is per role, per item, enforced at the database. Even if our application code had a bug, the database itself refuses the query.
| What | YouAlways | SpouseIf you link | AdvisorIf invited | ExecutorAfter activation |
|---|---|---|---|---|
| Your plan and readiness score | Full access | Full access | Full access | Full access |
| Inventory — accounts and property | Full access | Partial access | Partial access | Full access |
| Document Vault contents | Full access | Partial access | No access | Full access |
| Trusted Circle and roles | Full access | Full access | No access | Full access |
| Family Chronicle — shared entries | Full access | Full access | No access | Full access |
| Family Chronicle — private entries | Full access | No access | No access | No access |
| Activation Protocol settings | Full access | No access | No access | No access |
Every row is a setting you control per item, not a plan tier. Private entries stay private even after activation.
We read the envelope, never the letter
Email discovery finds accounts by looking at who wrote to you and when — sender domains, subject patterns, timestamps. Message bodies are never read, attachments are never downloaded, and nothing is stored.
What we haven’t done yet
Most security pages only list wins. We’re a young company, and you’re deciding whether to hand us the map of your life — so here’s the other column too.
- AES-256-GCM encryption with a unique key per vault item
- Ownership enforced on every API request, re-proven by a cross-tenant test suite on each deploy
- Append-only audit log — exportable as CSV or PDF, any time
- Authentication delegated to Clerk; we never store your password
- Full data export and 30-day deletion on cancellation
- Self-serve export of your whole plan, any time, without asking us
- Every administrative action recorded in a separate append-only log
- SOC 2 Type IINot started. Meaningful for enterprise buyers; we'll say so the day it's real.
- Third-party penetration testNot yet commissioned. Planned before general availability.
- Public bug bountyNo paid program yet — but disclosures are read and answered by a founder.
- iOS app in the App StoreIn TestFlight beta. Sign-in only, Face ID required, Keychain-backed — but not generally released.
We don’t outsource the decision that you’ve died. Third-party death verification is slow, leaky, and wrong often enough to matter, so we give you a veto and a clock you can watch instead. If you want a death certificate required before activation completes, that’s a switch in your Activation Protocol — set by you, not decided for you.
An audit log you can actually take with you
Every login, every vault touch, every access request and cancellation — timestamped, attributed, and append-only at the database level. Export the whole trail as CSV or PDF whenever you want it.
No. They see nothing until a request clears your grace period, and then only the items you designated for their role.
Export everything as CSV or PDF first. Data is retained 30 days, then permanently deleted — vault contents destroyed with their keys.
Yes. Every request is authorized against the account that made it, so a request for another user's record comes back empty. That rule is enforced in application code and re-tested on every deploy by a suite that tries to read other people's data and must fail to.
Your whole plan exports to CSV or PDF from your account whenever you want it — a button, not a support request. Leaving with everything has never required our cooperation, and it never will.
Enterprise identity with MFA and JWT sessions. Your password never touches our systems.
Master keys live in a hardware security module and never leave it. This is what makes envelope encryption real.
Every object is written with server-side KMS encryption, so what sits on disk is ciphertext and nothing else.
Read-only account discovery. We never see or store your banking credentials.
Card details go straight to Stripe. Nothing about your card is stored by us.
The SMS half of the notification you get the moment anyone files a request.
The safest plan is the one that only opens when you say so.
Found a vulnerability? Tell us — responsible disclosure →