Security
You're trusting us with some of the most sensitive information you have. Here's exactly what we do to protect it — described plainly, not oversold.
Encryption
Before storing them, we encrypt with AES: bank account and routing numbers, investment account numbers, insurance policy numbers, passwords you save for digital accounts, and uploaded wills, insurance policies, advance directives, and final-message audio and video. We hold the encryption key so we can deliver your information to your custodians, which means the service can technically decrypt these items; access is restricted by our access controls. Other information, including names, notes, contact details, photos, and miscellaneous files, is not individually encrypted by us. Our API accepts HTTPS connections only.
Authentication
Sign-in is handled by Microsoft Entra ID, the same enterprise identity platform used by Fortune 500 companies. We never see or store your password.
Infrastructure
Dad Is Dead runs on Microsoft Azure. Credentials for the external services we rely on (document storage, email, SMS) are stored in Azure Key Vault, and our application authenticates to Key Vault using a Managed Identity — not a stored username or password. Documents are stored with Cloudflare R2.
Access Control
Custodians you designate have no access to your vault while you're active. Access is granted only through our proof-of-life process, and you can reverse it at any time — even after a custodian has already been notified. You can also set any individual item to be visible only to specific custodians, so each person sees only what you've chosen to share with them.
What we're still building
Dad Is Dead is hosted on Microsoft Azure, which provides automatic database backups as part of its managed infrastructure. We're actively working on a formal, tested business continuity plan with defined recovery targets, and we'll publish it here once it exists rather than describe it before it does.