Security & trust
A continuity plan can contain deeply personal information. Here is what BeforeHand currently does to protect it, where your choices matter, and what no software can replace.
14-day free trial • Cancel anytime • $0 charged today
Built into the product
These statements describe protections implemented in the current product. We do not display certifications, audit seals, or compliance claims that have not been independently earned.
Sensitive plan details and uploaded documents are encrypted with AES-256-GCM before storage. Distinct encryption keys are used for separate data surfaces so one key is not reused across every kind of protected information.
Turn on Maximum privacy and your plan data is encrypted on your own device before it ever reaches us, with a key only you hold. We genuinely cannot read it, not through our database, not through our own systems. It's optional, not the default, because it comes with real responsibility: you'll save a recovery phrase, and losing it along with every device you've used means that data cannot be recovered by anyone, including us.
Every account needs a second check at sign-in, beyond the password or Google/Apple sign-in: a code from an authenticator app, or a one-time text-message code if you choose. Backup codes are provided in case you lose your device.
Plan owners control which trusted people receive access. A contact can be limited to assigned categories or grants, while owner-level information remains unavailable to people without permission.
Uploaded files receive a SHA-256 digest. That fingerprint helps the system detect whether stored file contents no longer match the file that was originally recorded.
BeforeHand records important events such as protected-information views and role-grant changes, creating an activity trail that supports review and accountability.
Reporting incapacity or death does not simply expose an entire plan. Evidence and workflow status are tracked, and executor access remains restricted until the applicable verification stage is satisfied.
Your controls
Important boundary
A security PIN can help conceal sensitive fields from someone looking at an unlocked screen. It is not a substitute for an account password, server-side permission, power of attorney, executor appointment, or an institution's identity checks.
BeforeHand helps organize and coordinate a plan. It does not bypass a bank, court, health provider, or digital platform's requirements.
Common questions
Sensitive fields such as account passwords and identification numbers, and uploaded documents, are encrypted with AES-256-GCM before they are stored, and BeforeHand's internal admin tools do not display the contents of anyone's plan. If you want a guarantee that doesn't depend on us, turn on Maximum privacy: your plan is then encrypted on your own device with a key only you hold, and we cannot decrypt it.
Only the people you choose. Nothing is visible to anyone by default. You can share a full plan, a single category, or a single item, most access stays inactive until you publish it, and you can revoke access at any time.
Reporting a life event does not unlock your plan instantly. Access you have tied to incapacity or death only activates after the event is reported and verified through a review of evidence. Once a death is verified, the Executor and family point of contact you named gain full access so they can settle your affairs; others see overall progress, not your records, unless you gave them specific access.
No. A name on your plan never creates legal authority by itself. Banks, courts, and health providers still require their own documents, such as a power of attorney or proof of an executor appointment.
Plan data and uploaded documents are stored with Supabase, our database and file-storage provider, with sensitive fields and documents encrypted before they reach storage. Payments are handled by Stripe; we never receive or store your card number.
No. We do not use the contents of your plan for advertising, profiling, or anything other than running the product you asked us to run.
Yes. Use “Request account deletion” in the iOS app's Account screen, or email hello@beforehandplan.com. We verify the request first, because deleting an account can affect other people's access, an in-progress account closure, or an active subscription. To request a copy of your data, email us and tell us what you need.
If you lose the recovery phrase along with every device you have used it on, that data cannot be recovered by anyone, including us. That is why Maximum privacy is optional, and you can switch back to standard protection at any time while you still have access.
Email hello@beforehandplan.com with enough detail for us to investigate. Please do not include passwords, backup codes, or sensitive documents.
For advisors, institutions, and partners
These are the core providers that store, process, or deliver account and plan information. For a security questionnaire or vendor review, email hello@beforehandplan.com and we will answer based on what is implemented today.
Questions or concerns
Read our privacy notice for information about data handling. If you believe you found a security issue or need help protecting your account, contact us with enough detail to investigate, but do not include passwords, backup codes, or sensitive documents.
Start before it is urgent