How we protect your information.

Two things, and it is worth keeping them apart. The first is this website, which almost anything you do here leaves untouched. The second is the work itself, a session or the full advisory service, which involves real information about your accounts and household.

Most of what follows is about the second, because that is the part worth asking hard questions about.

Only what you type into a contact form, or into Cal.com, the booking service we use, if you book a call or a session: your name, your email address, optionally a phone number, and whatever you choose to say. For a session, Stripe, the payment service, processes the payment, and we never see your card number. Nothing about your accounts or devices.

You do not need to arrive with an inventory, a list of logins, or any idea of where your gaps are. Producing that is the first part of the work, and it is ours to do. The privacy policy covers this website in detail.

One line runs through everything we do: we guide, you execute. Certain materials belong entirely to you, and our systems are not built to receive them. We do not hold:

• Your account passwords
• Recovery codes or backup codes for any service
• Seed phrases or private keys for any wallet
• One-time codes or authenticator secrets
• Any credential that would let us reach your accounts

When a step requires entering a password or writing down a recovery code, our guides walk you through it, but you perform it and you keep the result. We never ask you to send these to us. If you ask us to hold them anyway, the answer is no, and we will help you choose a proper custodian instead: your own safe, your attorney, or a professional fiduciary.

This is the difference between a policy and a design. A promise not to look at something can be broken. Not having it is a different kind of assurance.

The plan we build is deliberately split apart. The map of what exists holds pointers, not secrets: where a thing is kept, never what it is. The record of legal authority goes to your attorney or executor. The sealed recovery materials are segmented, so no single packet opens everything, and they sit with you or a custodian you choose.

We are the technical steward of that system and nothing more. No single document, and no single person, is the key to your entire digital life. That separation is the design, and it is what makes an arrangement safe to leave in place for years.

The site you are reading has no accounts, no sign-in, and no database. It stores nothing. A form submission is passed straight through to the client portal, which records it and notifies the advisor.

It loads one outside resource, the anti-spam widget on the two form pages. Its one typeface is served from our own servers rather than a third party. Keeping that list near zero is a deliberate choice: every additional script on a page is something else that could go wrong and something else that could watch you.

The portal runs on Supabase, which provides its database and identity infrastructure and holds SOC 2 Type II certification. A few specifics worth knowing:

• Your password is never stored in readable form. Authentication is handled by Supabase Auth, and we cannot see your password in any form.
• Records are isolated at the database level. Access rules make each client’s records reachable only by that client and their assigned advisor.
• Everything is encrypted in transit and at rest, using TLS between your browser and our servers and AES-256 for stored data.
• Access is limited and logged. Only the people who need your information to deliver your engagement can reach it.

By default, you and your advisor. Nobody else can see it in the portal unless you decide otherwise.

What a session keeps. If you book a session, our client portal keeps a record of it: your name, your email address, the time you booked, your answers to the questions before your session if you send them, your Exposure Snapshot, and our notes from the session. It never holds a password, a code, a PIN or a recovery phrase, and no AI service sees any of it. Your session page opens from a private link, with no account to sign in to. Anyone with the link can open it, so please don’t forward it.

An AI service, only in the full advisory service. To draft the Exposure Snapshot and written analysis for a plan in the full advisory service, we use an AI service from Anthropic. Nothing from a session goes to it. What we send can include your questionnaire answers, our notes and the written record of your interview, and the list of known data breaches that include your email address. We do not add your name or email address, but answers and notes go as written, so they can still identify you. Anthropic’s terms for business customers do not allow it to train its AI models on this information, and it may keep a copy for a period set by its own rules.

People you authorize. You may grant limited access to a trusted contact, an estate attorney, an executor, or a fiduciary. Every grant is started by you, scoped to what you approve, and revocable at any time. The levels that touch sealed recovery material are deliberately procedural rather than digital: the portal shows the instructions, never the materials themselves.

No digital system is ever the only thing standing between someone and your recovery material. That is on purpose.

We do not install software on your devices, hold standing access to your accounts, or leave a connection running when an engagement ends. We do not watch your accounts or alert you to anything, because we are an advisory and not a monitoring service. We never take an account over: changes are made with you, in systems you control.

Nothing you share is used for advertising, sold to anyone, given to data brokers, or used to train machine learning models.

We are asking you to write down how your digital life fits together. That record would be valuable to exactly the people it is designed to protect you from, which is why the boundaries above are built into the structure of the work rather than offered as assurances.

An advisory that quietly accumulated its clients’ credentials would become the single richest target among them. We would rather not be that, and you should not want us to be.