Trust Center
Security you can verify, not just trust
LifeWyn is built so that your privacy is never the price of protection. Here is how your vault is encrypted, what has to be verified before anyone else can open it, and where our limits are.
Zero-knowledge by design
Your vault is encrypted on your device before it ever leaves it, and the keys that open it are never sent to us. Your account details and your nominees' contact details are stored readable, because we cannot notify or verify someone whose address we cannot read.
Key management
Hierarchical envelope encryption: your master key derives Category keys with HKDF-SHA-256, and each asset and document gets its own random key wrapped under its category key. Inheritance shares are split with Shamir and encrypted to each recipient's public key. Server-side key wrapping uses a software key store today, not a hardware or managed KMS.
Modern cryptography
XChaCha20-Poly1305 authenticated encryption and HKDF key derivation on the client; TLS 1.2/1.3 in transit; threshold (Shamir) secret-sharing for escrow.
Hash-chained audit
Every sensitive action is written to an audit trail, each entry hash-chained to the one before it, and the hashes travel with audit exports so records can be checked against them. The store is not yet append-only at the database level, so we do not claim the trail is proof against an administrator.
Resilient infrastructure
Health-checked services, least-privilege access between components, and a single front door that validates every token. Encryption at rest is our hosting provider's default rather than a control we configure. Because your vault arrives already encrypted, a breach of our storage reaches ciphertext plus the account details we need to run the service — not your vault contents.
Recovery without lock-out
Arm recovery in advance — a recovery phrase, plus trusted contacts who each hold a sealed share — and a lost device stops being a lost vault. Recovery has to be set up before you need it: if it was never armed there is nothing on our side to restore from. Completing a recovery is currently web-only.
Certification status
What we have, and what we have not, certified
This is the section procurement teams open first, so it goes near the top rather than in a footnote. Nothing below is a logo we are entitled to display.
No SOC 2 Type I or Type II report exists. We have not begun an observation period.
No certificate, and no certification body has assessed us.
No test has been commissioned yet. Our first independent security review is scheduled for Q4 2026 and the report will be published here in full, including anything it finds.
Access, rectification, portability and erasure are built into the product. No supervisory authority or auditor has certified us against it, because no such certification exists.
Purpose limitation, recorded consent with a revocation history, and data-principal request flows. No certification scheme exists to attest to this.
Our encryption format and primitives are documented so anyone can inspect how it works, without waiting for an audit. See the architecture.
Data residency and processors
Where your data sits, and who touches it
All primary infrastructure is in India. Every sub-processor is bound by contract, and none of them can read vault contents, because none of them ever receives a key.
| Sub-processor | Purpose | Data location | Can it read the vault? |
|---|---|---|---|
| Oracle Cloud Infrastructure | Servers and storage | Mumbai, India (ap-mumbai-1) | No |
| Amazon SES | Transactional email | Mumbai, India (ap-south-1) | No |
| Razorpay | Payment processing | India | No |
| Twilio | Check-in notifications | Asia Pacific (Mumbai) | No |
Backups run nightly, are encrypted before they leave the server, and are kept on a rolling 30-day retention in the same region. This list is maintained on the compliance page.
Transparency
What we can and cannot produce
The honest version, including under a valid legal order.
What we can hand over
- Your account details — name, email, phone, country
- Billing records and subscription status
- Operational logs showing when the Service was accessed
- Nominee contact details you recorded
- The ciphertext of your vault
What we cannot produce
- Plaintext contents of your vault
- Your master password, or any key derived from it
- A working key of any kind — none exists on any system we control
- A support-desk override, master key or back door
- A password reset that still shows you your data afterwards
This is a description of what is technically possible, not a refusal to cooperate. We comply with valid legal orders from competent authorities. We intend to publish an annual transparency report; none has been published yet.
Documentation
Trust resources
How the zero-knowledge model, encryption, and key hierarchy fit together.
Our posture on GDPR, India's DPDP Act, and data-subject rights.
What we collect, what stays encrypted, and how we handle your data.
Scope, safe harbour, what we commit to when you report a vulnerability — and what we do not offer.
Live operational status of the platform.
Responsible disclosure
Found a vulnerability? Report it privately. We acknowledge within three working days, we will not pursue research done in good faith under our policy, and we will tell you what we did about it. There is no paid bounty programme and no published audit report — the full policy says so plainly.
Backups and availability
The database is backed up nightly and encrypted before it leaves the server, and there is a written restore procedure we rehearse. LifeWyn runs in a single region with no automatic failover, and there is no point-in-time recovery — a restore returns the platform to the last nightly backup. No uptime SLA is published yet.
System statusQuestions
What reviewers ask
- Do you have SOC 2 or ISO 27001?
- No. There is no SOC 2 report of any type, no ISO 27001 certificate, and no commissioned penetration test. Our first independent security review is scheduled for Q4 2026, and the report will be published here in full, including anything it finds. We would rather state that plainly than let a procurement team discover it later. What can be verified today is the architecture itself: every cryptographic primitive we use is a published standard implemented by audited libraries, and our encryption format is documented so anyone can inspect it.
- Where is our data stored, and can it stay in India?
- All primary infrastructure is in India. Account and billing data and encrypted vault contents both sit in Oracle Cloud Infrastructure, Mumbai (ap-mumbai-1), with backups in the same region on a rolling 30-day retention. Only limited operational data touches providers outside that region, and never vault contents. Because your vault is encrypted before it reaches us, the hosting region does not determine whether anyone can read it.
- What happens if you receive a legal order for our data?
- We comply with valid orders from competent authorities. What that produces is account details, billing records, operational logs, and the ciphertext of the vault. It cannot produce plaintext, because we hold no working key. That is a statement about what is technically possible, not a refusal to cooperate. We intend to publish an annual transparency report; none has been published yet.
- What is your uptime commitment?
- There is no uptime SLA published today, and we would rather say so than imply one. LifeWyn runs in a single region with no automatic failover, and there is no point-in-time recovery — a restore returns the platform to the last nightly backup. For an inheritance product this matters less than it would for a transactional service: the release sequence runs over days and weeks, not seconds, and your own export remains readable without our servers at all.
- Can you sign a DPA, or complete our security questionnaire?
- Yes to both. Write to support@lifewyn.com with what you need and we will work through it. We will answer a questionnaire honestly, including the questions where the answer is “not yet” — you will find those answers already on this page. We acknowledge within one business day and aim to return a completed questionnaire or a signed DPA within 10 business days.
- What happens to our data if LifeWyn is acquired or shuts down?
- You can export everything, any day, on any plan. The export is a documented open format that you decrypt with your own passphrase and recovery shares, so it opens without our servers and without our company existing. Because we never hold a working copy of your key, no wind-down, insolvency, acquisition or transfer of assets gives any party the ability to read your vault. If we ever have to close, our Terms commit us to at least 90 days’ advance notice with the export function available throughout.
Reviewing LifeWyn for your organisation?
Send us your questionnaire, your DPA, or just the question that is bothering you. A person answers, and we will tell you where the answer is “not yet”.