Passed PlanLegal

Last updated: May 2026

Security Overview

Security is foundational to Passed Plan, not an afterthought. This page describes the technical and operational controls we use to protect your data and your family's access to it.

1. Zero-Knowledge Encryption

Passed Plan is built on a zero-knowledge architecture: we cannot read the contents of your vault. All encryption and decryption happens on your device before data is sent to our servers. We receive and store only ciphertext.

Encryption Algorithms

  • Symmetric encryption: AES-256-GCM. All vault data — documents, notes, media metadata, beneficiary records, and Last Goodbye content — is encrypted with AES-256-GCM before leaving your device. GCM mode provides both confidentiality and integrity (authenticated encryption), so any tampering with ciphertext is detected on decryption.
  • Key derivation: PBKDF2-SHA256 with a minimum of 310,000 iterations and a random 128-bit salt. Your vault passphrase is never transmitted to our servers. The derived key is used only locally to encrypt your vault master key.
  • Key wrapping: Your vault master key is wrapped with your derived passphrase key using AES-256-GCM and stored server-side in encrypted form. Without your passphrase, the server-stored blob is computationally infeasible to decrypt.
  • Media files: Video and document files are encrypted with per-file AES-256-GCM keys before upload to Backblaze B2. The per-file keys are themselves encrypted with your vault master key.

What Zero-Knowledge Means in Practice

  • Passed Plan employees cannot read your vault, even with full database access.
  • A breach of our servers exposes only ciphertext, which is useless without your passphrase.
  • Government requests for vault contents cannot be fulfilled because we do not hold the plaintext or the keys.
  • If you lose your vault passphrase and have not configured recovery keys, your vault data is permanently inaccessible. We cannot recover it for you.

2. Authentication and Access Control

2.1 Account Authentication

Account authentication (login) uses Supabase Auth with bcrypt-hashed passwords. This is distinct from your vault passphrase: your account password grants access to the Passed Plan application; your vault passphrase decrypts your vault contents. They may be different values and serve different security purposes.

2.2 Multi-Factor Authentication (MFA)

MFA is required for all paid plan subscribers and is strongly recommended for free accounts.

  • Supported method: TOTP (Time-based One-Time Passwords) via any standards-compliant authenticator app (e.g., 1Password, Authy, Google Authenticator, Apple Passwords).
  • SMS-based MFA is not supported. SMS is vulnerable to SIM-swapping attacks. Given the sensitive nature of estate data, we do not offer SMS as an MFA channel — only TOTP.
  • Recovery codes are provided during MFA setup. Store them in a separate secure location (not your Passed Plan vault).

2.3 Session Management

Access tokens expire after 1 hour. Refresh tokens expire after 7 days of inactivity. All active sessions can be viewed and revoked from the Security section of account Settings. Signing in from a new device triggers an email notification.

3. Death Verification and Fraud Prevention

The most sensitive moment in Passed Plan's lifecycle is posthumous vault access. We apply multiple layers of verification to prevent fraud:

3.1 Death Certificate Verification via VitalChek

Trusted contacts must submit a death certificate through our integration with VitalChek, the leading provider of vital records verification. VitalChek cross-checks the submitted certificate against official vital records databases to confirm authenticity.

3.2 Trusted Contact Identity Verification via Persona

The trusted contact must complete a Know Your Customer (KYC) identity check via Persona, including government-issued photo ID verification and a liveness check. This ensures the person requesting access is who they claim to be.

3.3 The 72-Hour Fraud Window

After both verification steps pass, a mandatory 72-hour waiting period begins. During this window:

  • The account holder's registered email and phone number receive immediate notification of the access request.
  • Any person with access to the account holder's devices can halt the process using the I'm Alive feature (see Section 4).
  • The trusted contact cannot access the vault until the window closes.

The 72-hour window is non-negotiable and cannot be shortened, even with expedited payment or legal orders. It exists to protect living users from fraudulent access attempts.

3.4 Immutable Access Audit Trail

Every step of the death-verification and access process is recorded in an immutable, append-only audit log with cryptographic integrity protection. These records are retained for 7 years and can be provided to law enforcement or courts in the event of a dispute.

4. I'm Alive — Emergency Halt System

The I'm Alive feature allows an account holder (or anyone acting on their behalf) to immediately halt an in-progress vault access request during the 72-hour fraud window.

  • One-click halt: A unique, single-use halt link is included in every access-request notification email and SMS. Clicking the link immediately cancels the access request and alerts our security team.
  • No login required: The halt link works without logging in to the account, so it can be used even if the account holder has lost access to their password.
  • After a halt: The trusted contact cannot re-initiate an access request for 30 days. Repeated halt events trigger manual review.

5. Audit Logging

Passed Plan maintains an immutable, append-only audit log of security-relevant events. This log cannot be modified or deleted, even by Passed Plan administrators.

Events logged include:

  • Account login and logout (including device, IP, and timestamp)
  • MFA enrolment, changes, and bypass attempts
  • Vault key operations (re-encryption, recovery key generation)
  • Trusted contact additions, modifications, and removals
  • Death-verification initiation, progress, and outcome
  • I'm Alive halt events
  • Administrative access to account metadata (not vault contents)
  • Subscription and billing events
  • Data export requests

Audit logs use HMAC-SHA256 chaining: each record includes a hash of the previous record, making any tampering or deletion detectable. Logs are retained for 7 years.

6. Infrastructure Security

6.1 Hosting

The Passed Plan application is hosted on Vercel's global edge network with automatic TLS termination (TLS 1.3, with TLS 1.2 as fallback). All traffic is encrypted in transit. HSTS (HTTP Strict Transport Security) with a 1-year max-age and preload is enforced.

6.2 Database

User account data and encrypted vault metadata are stored in Supabase, which is SOC 2 Type II certified. Supabase data is encrypted at rest using AES-256 (infrastructure level, separate from our application-level encryption). Database access is restricted via Row-Level Security (RLS) policies: each user can only query their own rows.

6.3 Object Storage

Encrypted vault files (documents, videos, media) are stored in Backblaze B2. Files are encrypted at the application layer before upload (see Section 1) and are additionally encrypted at rest by Backblaze. Access to B2 buckets is restricted to signed, time-limited URLs generated server-side.

6.4 Secrets Management

API keys, database credentials, and other secrets are managed through Vercel's encrypted environment variable system and are never committed to source code. Secrets are rotated on a regular schedule and immediately upon any suspected compromise.

6.5 Dependency and Supply Chain Security

We use automated dependency scanning (Dependabot and Snyk) to detect and patch vulnerable dependencies. Our CI/CD pipeline includes SAST (static application security testing) checks on every pull request. Third-party dependencies are pinned to verified versions.

7. Penetration Testing

A comprehensive third-party penetration test is planned before the public launch of Passed Plan. We intend to conduct annual penetration tests thereafter. Summary findings (without exploitable details) will be published here following each engagement. Findings requiring immediate remediation will be addressed before publication.

8. Responsible Disclosure / Bug Bounty

We welcome reports from security researchers. If you discover a potential vulnerability in Passed Plan, please report it to us before disclosing it publicly:

Email: security@passedplan.com

PGP key: Available on request from the above address.

We ask that you:

  • Give us a reasonable time (at least 90 days) to investigate and remediate before public disclosure.
  • Avoid accessing, modifying, or deleting data that does not belong to you.
  • Do not perform testing that could disrupt availability for other users (no DoS, no automated high-volume scanning).

We will acknowledge all reports within 2 business days and will keep you informed of remediation progress. We appreciate responsible disclosure and will credit researchers who report valid findings (unless anonymity is preferred).

A formal bug bounty programme with defined scope and reward tiers is under development and will be launched pre-public-release.

9. Incident Response

In the event of a security incident affecting user data, we will:

  1. Contain and remediate the incident as quickly as possible.
  2. Notify affected users by email within 72 hours of confirming a breach, as required by applicable data protection law.
  3. Provide a clear description of what data was affected, what we have done in response, and what steps you can take to protect yourself.
  4. Report to relevant data protection authorities as required.

Because vault contents are zero-knowledge encrypted, a breach of our servers exposes only ciphertext. Affected users would not need to take action on vault data itself — but would be advised to rotate their vault passphrase as a precaution.

10. Security Contact

For security-related questions or concerns that are not vulnerability disclosures, contact security@passedplan.com.