Built like the paper matters.

The master key is a customer-managed key in AWS KMS. It never leaves the service, and every use of it is logged by AWS. Each account has its own key, generated by KMS and stored wrapped by the master. Each document has its own key, wrapped by the account key. An app server only ever holds an unwrapped account key in memory for the duration of a request or a job.

Deleting a document destroys its key immediately. The encrypted bytes are unreadable from that moment, before any backup rotates. Deleting an account destroys the account key, which makes every column and file in it unreadable at once.

Social Security numbers, account, policy, license, VIN and confirmation numbers are extracted as facts with the identifier role. They are encrypted with a blind index (a keyed hash of the normalized value) so "5521093" still finds the prescription, and they are redacted from page text before it is chunked and indexed.

That means the most sensitive strings in your documents are never sent to an embedding model and never sit in a plaintext index. The full-text index and, later, the vectors are derived from redacted text. We say that plainly because some products in this category store their search index and embeddings unencrypted.

Every row of every tenant table carries the account it belongs to, and the application scopes every query to the signed-in account. Underneath that, PostgreSQL row-level security is forced on every tenant table and the application connects as a role that cannot bypass it. A test in the suite runs a deliberately unscoped query and asserts it returns nothing from another account.

Passkeys first (Face ID, Touch ID, Windows Hello, security keys). A one-time email link, good for 15 minutes, is the fallback. There is no password to phish, reuse or leak. Sessions show up as devices you can sign out individually. Sign-in attempts are rate limited per address and per network.

Sign-ins, views, downloads, corrections, shares and key operations are recorded in an append-only log. Each row carries a hash of its contents and the previous row's hash, under a per-account lock, and the database refuses updates and deletes on the table. The log is kept for the life of the account and included in your export.

Files are typed from their bytes, not their names. Exact duplicates are recognised by content hash and linked, not stored twice. Email from senders you have not approved is held, not filed. Virus scanning and PDF re-rendering to strip active content are on the M2 list before public launch.

Documents are read by Claude through the Anthropic API. API inputs are not used to train models. We use models eligible for zero data retention and will move to a ZDR agreement when volume justifies it; until then retention is Anthropic's standard 30 days, and we say so. Ask sends only the excerpts that match your question, with identifiers already redacted.

Hosted on AWS in us-east-2 (Ohio). The database has automated backups with point-in-time recovery. Originals live in S3 with versioning and an object lock so nothing Thaw runs as can destroy a version early. The application tasks accept no inbound connections at all; the only path in is a Cloudflare tunnel.

Account deletion purges everything within 30 days; backups roll off within 35; keys are destroyed on day one.

Two things in Thaw work without a sign-in because the tools on the other end cannot sign in: the email-in address your scanner sends to, and the calendar subscription that puts Up next in Apple, Google or Outlook Calendar. Each is a long random token, scoped to one family or business, issued and rotated from Settings, and rate-limited. The calendar feed carries titles, dates and what to do; it never carries an identifier. Treat both links like a password, and rotate them the moment one leaks.

Settings builds an export on request: the originals decrypted into Category/Type folders named the way Thaw names them, every fact and link as JSON and CSV, the people & things, and the full audit log with its hash chain. The archive is stored under your account and downloadable for seven days through a short-lived signed link, then removed. Nothing in it is encrypted or redacted, because it is yours. A continuous mirror to your own Dropbox or Drive folder is on the roadmap.

security.txt is published, and reports are acknowledged within two business days. SOC 2 Type I is planned once the product is public. HIPAA does not apply to an individual storing their own records, and we do not imply otherwise; medical documents are treated as sensitive regardless.