Your valuables are locked before they leave your device.
This page says plainly what is protected, how, and what is not. AssetIntact is in a private build; nothing here has been reviewed by an outside auditor yet.
Locked on your device
Valuables, their photos and documents, your policy, the people you name and the estate assignments are encrypted in your browser with a key made on your device. Our servers store the locked result and never receive your passphrase.
You choose who can recover it
When you create your vault you pick one of two kinds. A private vault: we never have the key, so nobody at AssetIntact can open it, and we cannot recover it for you. A recoverable vault: we also keep a recovery copy of the key, so we can let you back in if you lose both your passphrase and your recovery key. Either way you get a recovery key to print.
You decide who else sees it
A co-owner gets their own copy of the key, locked to their account. An appraiser, insurer or lawyer gets a link to the items you pick, with a password you send separately, an end date, and a record of every time it is opened.
The three kinds of vault
| Vault | Where it lives | Who holds a key | If you lose your passphrase and recovery key | Sharing and roles |
|---|---|---|---|---|
| Recoverable | Our servers, encrypted in your browser | You, people you give access to, and a recovery copy held by AssetIntact | We can let you back in after checking that it is you | Yes |
| Private | Our servers, encrypted in your browser | Only you and people you give access to | Gone for good unless another person in the household has access | Yes |
| Local (desktop app, not released yet) | A file on your own drive, never uploaded | Only whoever has the file and its passphrase | Gone for good | No. Anyone with the file and passphrase sees everything in it |
A household starts with one cloud vault, recoverable or private, and can change between them later. A local vault can be added beside it. For firearms, and for anything you would not want disclosed under any circumstances, use a private or local vault.
When we use the recovery copy of a recoverable vault. Only in three cases: an owner asks us to recover the vault, an executor you named is verified after a death, or the law requires it. Each use is recorded where every owner can see it under Account, and every owner is emailed. The copy is stored encrypted, apart from the vault, and staff cannot browse vault contents. Because a copy exists, a court order or a serious breach of our systems could reach it; a private vault has no such copy.
Roles, and removing someone
An owner decides, person by person, what each role can open: the inventory, heirs and wishes, or both; view only, add only, or add and edit; from now or only after a waiting period; and until what date. Heirs and wishes are sealed with their own key, so a person who is not given that key cannot read them even if they can see the inventory. Executors, lawyers and advisers can only view.
Removing a person ends their access at once and is free: they can no longer open or download anything. It cannot erase what they already saw. If they had vault access they could have kept a copy of a key, so you can re-key the vault: your browser makes new keys, re-seals everything and gives the new keys to everyone who stays. A re-key is a paid service ($49). A local vault has no roles and no fee: you change its key yourself in the app.
What is protected which way
| Information | How it is stored | Who can read it |
|---|---|---|
| Valuables, photos, appraisals, documents, policy, heirs and estate assignments, shared links | Encrypted on your device before upload | You, and people you give a key to. For a recoverable vault, AssetIntact in the three cases above |
| Home systems, appliances, vehicles, tasks, service history, vendors | Encrypted in transit and on disk, readable by the service | Your household. The service reads it to send reminders and check recalls |
| Account email, household members, plan | Encrypted in transit and on disk | Your household, and AssetIntact staff for support and billing |
The details
- Vault contents: AES-GCM with a 256-bit key, a fresh random value for every record and file.
- Your passphrase is stretched with PBKDF2-SHA-256, 600,000 rounds, to lock the vault key. The passphrase itself is never sent.
- Sharing with a co-owner or executor uses a personal RSA-OAEP 2048-bit key pair; the private half is locked with that person's own passphrase.
- Every row in the database is restricted to its own household by database rules, not only by the app.
- The access log records views, exports, changes and shares, and cannot be edited or erased.
When you use the AI buttons
Add from a photo, Suggest the maker, and reading a label or a receipt send the photos you pick, shrunk, through our server to outside AI services for that one request: Google and Anthropic to draft an item, OpenAI for the others, each as a backup for the other. It is your choice each time; nothing is sent unless you press the button, and the rest of your inventory is never included. We do not store or log the photos. We keep what the AI answered, with no photo and no link to an account or household, to check and improve the results. Those services handle them under their own terms for business API use. This is the one moment a photo from an encrypted vault is readable outside your device, so each vault has a switch under Account to turn AI import off.
Your data is yours
- Export everything at any time, in open formats.
- Delete your account and the records, files and keys go with it.
- No selling or sharing of your information, and no ad networks or ad tracking. We show no advertising today. If we ever show a sponsored card, it will be a plain link we chose ourselves, labeled Sponsored, with nothing about you passed to the sponsor.
What is not in place yet
- An independent security review.
- Two-step sign-in.
- A local-only vault that keeps chosen items, such as firearms, on your own computer or phone and off our servers entirely, with a backup file for a USB drive in your safe. This is designed and in progress.
- A re-key does not happen by itself when someone is removed. An owner starts it (see Roles, and removing someone, above).
Protecting your passphrase and recovery key is up to you. Anyone who has them, along with your sign-in, can open the vault.