Keepacy™ is built around encryption, access control, and compliance from the ground up — not bolted on as an afterthought.
Documents encrypted with AES-256-GCM: on your device if your account uses device keys, on our servers if it doesn't yet.
Nothing is released until a member of our staff approves a death certificate. On accounts that use device keys, Keepacy's servers hold no key that can open your documents. On older accounts, Keepacy holds a recovery key used only for beneficiary release and account recovery.
A one-time code by email on every account, plus authenticator apps (TOTP) and passkeys.
Download your documents, ask for a copy of your data, or ask us to delete it. We never sell your personal information.
Name beneficiaries under a digital asset directive (NY EPTL Article 13-A, RUFADAA). Your consent and the directive text are recorded for each beneficiary.
Continuously scanned against OWASP Top 10 vulnerability categories.
Security is not a feature we added — it is the foundation everything else is built on.
Every document is encrypted before it reaches storage using AES-256-GCM with a unique key. On accounts that use device keys, your device does the encrypting. Data in transit is protected by TLS. Even if our storage were compromised, your files remain ciphertext.
On an account that uses device keys, your documents are encrypted on your device and Keepacy's servers hold no key that can open them. Your devices and your recovery kit can. After we confirm your death, the people you approved, and whoever holds a Legacy Letter or Legacy Card you made and passes our checks, open what you shared on their own devices. What you share goes only to people approved from your own device: someone you invited who answered your question, or someone you checked yourself. If your answer is easy to guess, or you set no question, someone in control of Keepacy's servers could pose as that person. On an older account, Keepacy holds a recovery key that is used only for beneficiary release and account recovery, and uses it to release documents after we confirm your death. Once your check-ins lapse, the people you named can see the title, category and dates of each document you share with them, and nothing else about it. No beneficiary can open a document until we confirm your death.
Before anything is released, Keepacy runs a staged, multi-channel escalation over days, and a member of our staff must approve a copy of your death certificate. On accounts that use device keys, we then wait 72 hours and tell you, and a check-in cancels the release. A missed check-in never triggers a release on its own.
Login attempts, document downloads, beneficiary changes, vault releases, and each time our staff view a claim document are logged with timestamps. We keep the audit log for 3 years after an account is deleted. Records of a digital asset directive are kept after that, with no end date set yet. A record of what the people you named opened is kept while they are listed.
Encryption Architecture · Older Accounts
Your documents are protected by envelope encryption. Each document is encrypted with its own unique key, and multiple layers of key wrapping ensure your data remains secure at rest. Alongside your password-derived key, Keepacy holds a recovery key that is used only for beneficiary release and account recovery. This is how accounts that haven't moved to device keys work. On accounts that use device keys, Keepacy's servers hold no key that can open your documents; see Device Keys below.
Your Password
Only a bcrypt hash is stored; the password itself derives your key each session
Key Encryption Key (KEK)
Derived in your browser each session; held in memory only, never persisted
Data Encryption Key (DEK)
Unique per document
Your Documents
Encrypted at rest in cloud storage
Expand any section below to see exactly how Keepacy implements each security control.
Start with the free plan. Your documents are encrypted from the moment you upload them.
