How we keep it safe

Secrets are encrypted one by one

Passwords, PINs, passcodes, account and routing numbers, tax IDs and policy numbers are each encrypted with AES-256-GCM before they are saved. Someone who copied our database would see scrambled values, not your secrets. The rest of your plan (names, phone numbers, notes) is protected by our database provider's encryption at rest, and everything travels over an encrypted (TLS) connection.

You sign in with a one-time code sent to your email; there is no Stillago password to steal.

Who can see what

"The plan" means who to call, what to do first and where things are. Where a secret would be, people without access see "Hidden until full access is unlocked" instead.

Each designated person has their own key

Everyone you choose gets their own private link and their own PIN. PINs are stored hashed, so we can't read them either. Wrong PINs are rate-limited. You get an email when someone opens their link (at most once an hour per person), and you can revoke one person without affecting the others.

The ways full access opens

1. You open it, from Settings, at any time. You can hide everything again just as easily.
2. A family member asks for it. You get an email and a dashboard alert straight away. If you don't decline, it opens after your waiting period (you choose 1 day, 2 days, 3 days, 7 days; the default is 2 days). If you chose more than one person, a second one (another family member or your attorney) must confirm it too, so nobody can open your secrets alone. Opened this way, it closes again by itself after the length you set (30 days by default).
3. The check-in hand-over completes. If you turn on check-ins and stop answering, your designated person is asked if you're OK, and you get time to say you're fine before anything is handed over.

Advisors never see secrets, whichever way access opens.

If you're alive but can't work

Incapacity mode is for a hospital stay or a long recovery. Only the few secrets you picked ahead of time open (for example the payroll bank login), for a limited time. Your family is told you expect to come back and not to cancel, sell or sign anything long-term, and they see your own “Please don't…” list. It starts the same careful way: a waiting period you can decline, plus a second person's confirmation. When you're back, one click hides everything again and shows you what they did.

Every secret is opened one at a time

Even with access, your people see a “Show” button, not the password. Each one they open is recorded with who and when. You see it in Settings, and once a week you and everyone you chose get the list, so nothing is opened without someone else knowing. Downloading the PDF, which prints whatever is open to them, is recorded and listed too.

If a link or PIN is lost

A designated person can ask for a new link. It never happens instantly: you are emailed and can block it. If another person you chose vouches for them, the new link is sent after 2 days. If no one vouches, it waits 7 days and then our team checks who they are before sending anything. The new link only works with a new PIN, and the old link stops working.

What's recorded

Every time someone opens a link, every wrong PIN, every full-access request and decision, and every recovery request is logged. You can see who opened their link, and when, in Settings.

What we never do

• Sell or share your data.
• Send your saved passwords or account numbers to an AI service. If you dictate an answer by voice, the recording is transcribed by OpenAI; if it sounds like a password or PIN, we throw it away instead of saving it.
• Show secrets to advisors or to anyone on a practice run.

What's on you

The PDF of your plan leaves passwords and account numbers out unless you choose to include them. If you do, store it like a paper copy of your passwords. Give each person their PIN separately from their link; the printed envelope kit leaves the PIN off for that reason.