Security
Your most personal information.Protected like it.
MyLegacyInfo stores some of the most sensitive data you own: wills, bank accounts, passwords, medical details. We've built the security to match. Here's exactly how.
AES-256-GCM field-level encryption
The most sensitive fields in your vault (bank account numbers, sort codes, National Insurance number, passport number, policy numbers, and every entry in your Password Vault) are encrypted with AES-256-GCM before they are written to the database.
This means that even if someone obtained a raw copy of the database, they would see only ciphertext, random bytes that are mathematically impossible to reverse without the encryption key. The key itself is stored separately from the data, in an environment variable on the server, never in the database.
What this looks like in practice
What you type
Barclays · sort code 20-00-00 · account 12345678
What's stored in the database
3a8f2c1d:9b4e7f2a1c8d3e5b:a1b2c3d4e5f67890abcdef1234567890...
What your executor sees (after authentication)
Barclays · sort code 20-00-00 · account 12345678
AES-256-GCM also includes an authentication tag, it detects if the ciphertext has been tampered with at rest.
Your login password is never stored
When you create a MyLegacyInfo account, your password is run through bcrypt with a cost factor of 12, a one-way hashing algorithm designed to be deliberately slow to compute. What's stored in the database is the hash, not your password.
This means no one, not even the MyLegacyInfo team, can ever see your password. When you log in, bcrypt re-hashes what you typed and compares it to the stored hash. If they match, you're in. If the database were ever leaked, the hashes would be worthless to an attacker.
Why bcrypt?
Deliberately slow
bcrypt is designed to take ~100ms to compute. That makes brute-forcing millions of guesses per second infeasible.
Unique salt per password
A random salt is mixed in before hashing, so two users with the same password produce completely different hashes.
Cost factor 12
Each time computing power doubles, we can raise the cost factor to keep hashing just as slow against future hardware.
Account lockout & rate limiting
After 5 failed login attempts your account locks automatically for 15 minutes. Your IP address and email are rate-limited independently, so both attack vectors are blocked simultaneously.
Full audit trail
Every login, failed login, data change, and every time a trusted person accesses your vault is timestamped and stored. You can review the full history in your Security page at any time.
Granular access control
Trusted people get only what you give them. Share your Care Plan with a carer but keep your finances private. Share everything with your executor and nothing with anyone else. Your call, always.
Access codes, not passwords
Trusted people are given a separate access code, completely independent of your password. Invitations expire in 7 days if unused. You can revoke access at any time. Your vault stays yours.
GDPR & UK data law
All data is stored on servers in the UK. We never sell your data or share it with advertisers. You can export a full copy of your vault or request permanent deletion at any time, no questions asked.
Secure document storage
Uploaded documents (wills, passports, insurance policies) are stored with server-side validation on file type and size. Each file is stored under a cryptographically random key, not the original filename. Documents are never served as public files — every download is authenticated and checked against your account before the file is streamed back.
Common security questions
Can MyLegacyInfo staff read my data?
The most sensitive fields (account numbers, National Insurance number, passport details, and everything in your Password Vault) are encrypted before they reach the database, and your login password exists only as a bcrypt hash that cannot be reversed. Operational access to systems is restricted, and every access to your vault is recorded in the audit trail you can review yourself.
What happens if MyLegacyInfo's database were breached?
An attacker with a raw copy of the database would see ciphertext for encrypted fields, random bytes that are mathematically infeasible to reverse without the encryption key, which is stored separately from the data and never in the database. Password hashes are bcrypt with a cost factor of 12, making bulk cracking impractical.
How do trusted people get access without my password?
They never use or see your password. Each trusted person receives their own access code, generated when you invite them. Codes are independent of your credentials, invitations expire after 7 days if unused, and you can revoke any person's access instantly. Executor access codes are rate limited per code and per IP address, so they can't be brute-forced.
Where is my data stored?
On servers in UK data centres, under UK GDPR. You can export a full copy of your vault or request permanent deletion at any time.
Security you can verify.
Peace of mind you can feel.
Every login and every access to your vault is recorded, see it for yourself.