Security at Don't Panic
Passports, policies, contracts, and family records reveal a lot. We design the Vault around that reality, with narrow access, private delivery, and an honest account of what is protected now and what must be finished before launch.
Protected today
These statements describe application behaviour that exists in the codebase and is covered by automated tests. Infrastructure guarantees still depend on the production environment being configured correctly.
01 / ACCESS
Every authenticated Vault request is scoped to the signed in, verified user's household. Policy checks prevent one household from opening, changing, or deleting another household's documents. A public share is a separate, expiring capability for one document.
02 / DELIVERY
Originals and previews pass through the application after an access check. Responses are marked private and not stored by shared caches. The storage bucket is never intended to be a public website.
03 / SHARING
A public share is limited to one document. Its secret is stored as a hash, can expire, and can be revoked. Normal Vault links still require an authenticated session.
04 / ACCOUNT
You can protect your account with authenticator app based two factor authentication and recovery codes. Sensitive document activity is recorded so access has a trail.
Document journey
We treat previews, extracted text, search data, and exports as sensitive too. A thumbnail is still your information.
Upload
Type and size rules reject unsupported files. Documents that have not passed the release gate remain unavailable for preview and download.
Store
The intended production home is a private Cloudflare R2 bucket. R2 encrypts objects at rest with provider managed keys and uses TLS for API connections. We will verify the resolved production configuration before making that a production guarantee.
Use
Document extraction requires server readable content, so this is not end to end encryption. Before real documents are sent to an external model, zero retention terms, region, purpose, and provider must be documented.
Delete
Deleting a Vault document removes it from normal use immediately and schedules its live file and database record for purge after the recovery window. Backup retention determines when historical recovery is no longer possible, so our final retention promise will be tied to verified operational evidence.
Before public launch
These controls are decisions in the security specification, but they are not complete. We will not present them as current protection until implementation and production evidence agree.
A fresh encryption key for every document, wrapped by a managed key service, covering originals, previews, extracted content, and persistent exports.
Malware scanning is not yet active. The current rollout status makes that absence explicit. Public launch requires a scanner that fails closed and records its result, time, and engine.
Private bucket settings, database TLS, encryption at rest, location, credential scope, lifecycle rules, backups, and restore tests all need current evidence.
Search indexes must exclude protected identifiers. Any unavoidable temporary plaintext needs private permissions, short retention, cleanup on failure, and an independent scavenger.
Plain speaking
The application must read documents to extract useful details. Anyone claiming both server side AI extraction and a service that can never read your documents is describing incompatible things.
Our chosen boundary is encryption before storage under application controlled keys. That protects against storage credential and bucket failures, but not a compromised application server.
Compliance language will name its scope, evidence, and review date. A badge is not a substitute for a control that works.
Questions are welcome
This page will change as controls move from specification to verified production behaviour. We would rather show that movement than flatten it into a permanent promise.
Contact securityOur security disclosure file contains the monitored reporting address.