Every layer of Heirloom Sovereign is built for security, from the moment you upload to the day your great-grandchildren open the vault.
Multiple layers of security work together to guard every piece of your family's data.
Your data is encrypted in transit (TLS 1.3) and at rest (AES-256) through enterprise-grade infrastructure from SOC 2 audited providers.
We use passwordless authentication. You log in with a one-time code sent to your email. No passwords are stored anywhere, so there's nothing to leak and nothing to hack.
Every upload is signed server-side before it reaches storage. Files can't be tampered with. Legacy plan members can seal any memory on the Polygon blockchain, creating a permanent, tamper-proof timestamp that anyone can verify.
No Google Analytics. No Facebook Pixel. No third-party trackers. We use first-party analytics only. Your browsing behavior is never sold or shared.
Here's what's running behind the scenes to keep your family's memories safe.
HSTS with preload enabled. Every connection between your browser and our servers is encrypted. No exceptions, no downgrades.
We whitelist exactly which scripts and connections are allowed on our site. Everything else gets blocked, which prevents code injection and cross-site scripting attacks.
Session tokens can't be accessed by JavaScript, are only sent over HTTPS, and are locked to our domain to prevent cross-site request forgery.
Every sensitive endpoint is rate-limited. Login attempts, uploads, and API calls all have strict per-user caps. Brute force attacks are blocked automatically.
All submitted data is sanitized, validated, and length-limited before it touches our database. Bad input gets rejected at the door.
Only tryheirloom.family can communicate with our API. Cross-origin requests from any other domain are blocked. Your data stays where it belongs.
We build on platforms trusted by millions of businesses. Every certification listed here is public and audited.
Cloudinary
ISO 27001AES-256 encryption at rest. Stores all your photos, videos, and voice memos.
Supabase
SOC 2 Type IIPostgreSQL with Row-Level Security. Every query is scoped to your family's data. No cross-contamination.
Netlify
SOC 2Global CDN with built-in DDoS protection. Your vault is fast and resilient from anywhere in the world.
Stripe
PCI DSS Level 1Handles all payment processing. We never see or store your credit card number. Ever.
Anthropic
AI Safety LeaderPowers Sage, our teen AI companion. Conversations are processed in real-time and never used to train models.
Polygon
Blockchain ยท MainnetOur HeirloomVault smart contract stores immutable content hashes on Polygon Mainnet. Proves your memories existed at a specific moment in time. Tamper-proof and publicly verifiable.
Teens won't be honest if they think someone is watching. So we made privacy the architecture, not just a feature.
Teen conversations are stored in a separate database table that parents can't access. Parents only see AI-generated themes and mood summaries. This isn't a setting you can toggle. It's the database design.
Sage proactively tells teens what parents can and can't see in the very first message. No hidden surveillance. No secret reporting. Trust is the foundation of everything Sage does.
Every message runs through two independent AI safety checks. Mild concerns appear in weekly digests. Moderate concerns trigger same-day alerts. Severe concerns trigger immediate notification plus crisis resources for your teen.
Sage requires age verification (13 to 18) before activation. Birth year is validated server-side, and parents have to explicitly enable Sage for each teen. It's never turned on automatically.
You should have full control over your family's memories and information. Here's what that looks like.
Request a full export of your vault, memories, and metadata at any time. Your data is yours to take wherever you go.
Request complete deletion of your data. We honor all deletion requests promptly and permanently.
We list every third-party service that touches your data in our Privacy Policy. No hidden partners, no surprise data sharing.
We will never sell, rent, or share your personal data with advertisers. Your family's memories are not a product. Ever.
Your family's stories, voice memos, and photos are never used to train any AI model. Your data powers your family's experience and nothing else.
Enterprise-grade security from day one. Because your family's stories are worth protecting.
Begin Your LegacyFree forever to start • No credit card • Cancel anytime