Trust needs specifics.

Here is what exists in the private build, what it means, and what is still being developed.

Current private-build safeguards

• Vault content and attachments are encrypted on the server using AES-GCM.
• Two-factor authentication and account-scoped authorization checks are implemented.
• Structured account activity records capture important changes.
• Vault lists use summaries; individual contents are decrypted when opened.

Encryption boundaries

The standard vault uses server-side encryption. The application server can decrypt that content using its configured keys. Security depends on account protections, application controls and correct operational key management.

The separate E2EE beta encrypts new notes, titles, filenames and attachments in your browser. Existing standard-vault items are not automatically migrated. Its recovery kit and separate vault passphrase are not account sign-in credentials: an email or password reset cannot unlock that encrypted content. The E2EE implementation has not had an independent audit and remains a fictional-data beta; it is not a claim that all Digital Keep data or metadata is end-to-end encrypted.

Storage, history and deletion

Vault records use Cloudflare D1 and encrypted attachments use private Cloudflare R2 storage. Vercel hosts the public website and Resend sends transactional emails. These services have separate processing and retention arrangements; we do not claim that all processing stays in one country or region.

The owner’s activity history records sharing changes, shared items served and attachment downloads authorized from release 2026.10.04.5 onward. It records the acting account, resource reference and time, without copying vault content into the log. A served response does not prove someone read or saved it. Earlier reads are not reconstructed. Recorded history is included in the password-confirmed account export.

Account deletion blocks sessions and removes active account data. Attachment deletion is queued and retried. A private receipt lets you check progress without keeping an account; it shows dates, not your identity or vault. The receipt and pseudonymous deletion ledger are retained for 90 days. Another person’s independently owned history may retain an anonymous reference.

After beta access expires, confirm a data-access request with your account email and configured 2FA to export or delete your own data. This grants no workspace or sharing access. Locked and revoked accounts require a separate verified support review.

Managed backups and recovery

A Cloudflare Workflow creates encrypted database and attachment snapshots, verifies copied-object hashes and publishes a manifest only for a complete snapshot. Recovery key copies are held separately in a restricted Vercel recovery project. The backup service does not receive the vault decryption key.

Cloud maintenance expires managed snapshots after 28 days, leaving retry time within the 30-day deletion target. A deletion receipt confirms backup cleanup only after it has been checked. The independent deletion ledger must be reapplied to older restored data before access is opened. Provider-managed infrastructure recovery copies have separate retention periods; this receipt does not certify their erasure.

Restore verification decrypts into an isolated local database, checks integrity, references and file hashes, reapplies recorded deletions and removes temporary plaintext afterward. Restored sessions, login links and immediate shares are invalidated; owners must grant fresh sharing access. This is separate from the cloud snapshot check. No guaranteed recovery time or independent certification is claimed. The current cloud exporter is bounded for the small beta; exceeding its limits stops publication and requires operator attention.

Sharing at your request

Your vault starts private. To share now, you choose a person, select individual items or the entire vault, and confirm your password and configured two-factor authentication. The recipient must use the matching verified email address, accept your connection invitation and have eligible beta access. A connection invitation does not itself enroll someone in the beta.

Shared access allows reading and downloading, not editing. Entire-vault access includes future items. You can set an expiry, change the selection or revoke access; current permissions are checked on reads and downloads. Revocation cannot erase copies that a recipient has already saved. Inheritance assignments are separate and do not grant access now.

Before legacy release goes live

Operational beneficiary and death verification, reviewer permissions and release procedures are still being developed. Invitation acceptance does not verify someone’s identity or a death. Death reports and legacy delivery are not active public services, and there are no government death-registry integrations.

The public waitlist

The marketing site is deployed separately from the private application. Its server validates submissions, limits request size and rate, and stores signup details in a dedicated database. Database credentials stay on the server. The waitlist is not a place to store sensitive legacy information.

Security reports

Contact contact@digital-keep.com with a description of a potential issue. Please omit secrets and other people’s personal data. No independent security certification or formal response-time commitment is claimed.