Security
Your most personal information.Protected like it.
Wills, bank accounts, passwords, medical details. Most of it is encrypted in your browser before it reaches us, with a key only your passphrase unlocks. Here's exactly how it works.
Encrypted in your browser with AES-256-GCM
Names, addresses, ID and account numbers, notes, letters, wishes, the wording of your will and your care details are encrypted with AES-256-GCM in your browser, before they leave your device. Our servers refuse to store them unencrypted.
The key that opens your vault is created in your browser and stored only in locked form, sealed by your passphrase through 310,000 rounds of PBKDF2. Anyone holding a raw copy of the database would see only ciphertext, which is computationally infeasible to decrypt without that key. A separate server key, kept outside the database, protects the few details we must read without you, such as your trusted people's email addresses, and your saved passwords, which are decrypted only when you or someone you allow presses Show.
What this looks like in practice
What you type
Barclays · sort code 20 00 00 · account ending 5678
What's stored in the database
e2e:Q6PuE1vWVD5tGF8A:kZ8xN3vR2bT9wLmC4yHq7sPe0aUj5dXo…
What your executor sees, once their access opens
Barclays · sort code 20 00 00 · account ending 5678
Every value carries an authentication tag, so any change to the stored ciphertext is detected and rejected.
Your login password is never stored
When you create a MyLegacyInfo account, your password is run through bcrypt with a cost factor of 12, a one way hashing algorithm designed to be deliberately slow to compute. What's stored in the database is the hash, not your password.
Your password is checked when you sign in and is never stored, logged or shown to anyone. bcrypt hashes what you typed and compares it with the stored hash. If they match, you're in. A leaked hash is slow and expensive to attack, and a strong, unique password keeps it that way.
Why bcrypt?
Deliberately slow
At cost factor 12, every single guess takes a noticeable fraction of a second, so trying millions of guesses becomes impractical.
Unique salt per password
A random salt is mixed in before hashing, so two users with the same password produce completely different hashes.
Cost factor 12
As computers get faster, the cost factor can be raised for new passwords, so hashing stays slow against future hardware.
Account lockout & rate limiting
After 5 wrong passwords in a row, sign in to your account locks for 15 minutes. Attempts are limited separately per email address and per IP address, so both routes of attack are blocked at once.
Full activity log
Every sign in, failed sign in, change to your vault and visit from a trusted person is logged with the time, IP address and device. Your Security page shows your recent activity, and you're emailed when a trusted person opens your vault.
You decide who sees what
For each trusted person you decide whether they wait for a verified death and whether they can see your passwords, and you choose which letters and documents they may open. On a Family plan, members choose exactly which sections to share with each other. Your call, always.
Their own account, never your password
A trusted person can only open your vault from their own MyLegacyInfo account, which is free and included in your plan. No page shows a vault to someone holding only a code. You invite them with a single use code that has nothing to do with your password. Invitations expire after 7 days if unused, and you can revoke access at any time.
UK data law
Your vault and files are stored in London and handled under UK GDPR. We never sell your data, show you adverts or use tracking cookies. You can download your documents, or close your account and delete your vault, at any time, no questions asked.
Secure document storage
Uploaded documents (wills, passports, insurance policies) are encrypted in your browser before upload, and limited to PDFs, images and Word files up to 4 MB. Each file is stored under a cryptographically random key, not the original filename. Documents are never served as public files. Every download needs your own signed in session and is checked against your account first.
Death verified before access
By default, trusted people can open your vault only after a death has been reported with a certificate and checked by our team. You are emailed straight away and have 48 hours to dispute the report.
Two step verification & auto lock
Add an authenticator app to your sign in, backed by ten single use recovery codes. Your vault locks itself after 5 minutes without activity or when you close the tab, you can lock it yourself at any moment, and you are signed out after 12 hours away.
Recovery, never silent access
If you lose your passphrase, it can be recovered only from a sealed store our app cannot read, against a signed written request. Every recovery is recorded in your own activity log, and you choose a new passphrase straight after.
Common security questions
Can MyLegacyInfo staff read my data?
Not your vault. Most of it is encrypted in your browser with a key that only your passphrase unlocks, and our servers refuse to store those details unencrypted. A few details stay readable to our systems because they must work without you, such as your trusted people's email addresses for a death notice. Your login password exists only as a bcrypt hash. The one exception is the optional AI check of your will, which runs only when you ask for it.
What happens if MyLegacyInfo's database were breached?
A stolen copy of the database would hold your vault only as ciphertext, locked by a key that only your passphrase opens. To read it, an attacker would have to guess your passphrase against 310,000 rounds of PBKDF2 and a bcrypt hash. Login passwords are bcrypt hashed with a cost factor of 12, which makes bulk cracking impractical.
How do trusted people get access without my password?
They never use or see your password. Each trusted person is invited with their own single use code, and that code opens nothing by itself. A trusted person can only open your vault from their own MyLegacyInfo account, which is free and included in your plan. No page shows a vault to someone holding only a code. When their access opens, their browser decrypts your vault with a copy of your key that only they can unlock. Invitations expire after 7 days if unused, and revoking someone takes effect immediately and deletes their copy of your key. Invitation codes are rate limited per code and per IP address, so they can't be guessed by brute force.
Where is my data stored?
Your vault and files are stored in London, under UK GDPR. A few providers, for email, payments and the optional AI will check, process limited data elsewhere under UK approved safeguards. You can download your documents, or close your account and delete your vault, at any time.
What stops someone falsely reporting my death?
Only one of your trusted people or a member of your Family plan can report a death, and they must upload a death certificate. We email you straight away, you have 48 hours to dispute the report, and our team checks it before any access opens.
What happens if I forget my passphrase?
Your vault can't be reset online, because a reset would make your encrypted data unreadable. Instead, your passphrase is held in a separate sealed store that our app can write to but never read. It is released only against a signed written request, the release is recorded in your activity log, and you choose a new passphrase the next time you unlock.
Security you can verify.
Peace of mind you can feel.
Every sign in, every change and every visit from someone you trust is logged. See it for yourself.