Security
Keys in a key service. Identifiers never in an index.
Every file is encrypted with its own key, every account with its own, and the master key lives in AWS KMS, never on an app server. Deleting a document destroys its key immediately.
Envelope encryption
Per-document keys, wrapped by a per-account key, wrapped by a hardware-backed master key. Every unwrap is logged by the cloud provider.
Identifiers stay sealed
Social Security numbers, account and policy numbers are encrypted with a blind index for exact search and redacted before any text is indexed or sent for embedding.
An audit log that cannot be quietly edited
Append-only and hash-chained at the database level. Sign-ins, views, downloads, shares and corrections, for the life of the account.
Deletion that is real
Delete a document and its key is gone that second. The encrypted bytes are noise from then on, backups included.
Details
- Passkeys first, an email link as the fallback, no passwords.
- Postgres row-level security enforces tenant isolation under the application, not just in it.
- A full write-up is on the security page.
Questions
Where is it hosted?
AWS, us-east-2 (Ohio), in a dedicated network with no inbound path except a Cloudflare tunnel.
Also
Inbox and email-in
Every family and business gets an email-in address. Forward a bill, point the scanner at it, or drop a file, and it is read and filed within a couple of minutes.
First import
Point Thaw at the pile you already have: a folder, an Evernote export, a paperless-ngx export. Come back to a map of your household or business and a list of what is missing.
Map of people & things
The home screen is not a list of files. It is the people, pets, vehicles, properties, accounts and businesses in your life, each with what is current, what is next, and what is missing.
Point it at the pile and walk away.
Early access is open to a small group of households and owner-run businesses. Tell us a little about your paper and we will send an invitation.