Security & trust
You're entrusting us with your family's most sensitive documents. Here's how we protect them.
Encryption at rest
All documents are envelope-encrypted with AES-256-GCM. Each document gets its own data-encryption key (DEK), wrapped by an AWS KMS key. If S3 leaks, ciphertext alone is useless.
Encryption in transit
TLS on every connection, with HSTS preload.
Passwordless sign-in
Sign in with an email magic link or Google. There are no passwords to steal or reuse.
Audit log on every action
Every sensitive mutation writes an append-only audit record with actor, IP, user-agent, and timestamp — including Tembo AI requests (metadata only, never prompt bodies).
SOC 2 + HIPAA aware
SOC 2 Type I planned for end of 2026, Type II by Q3 2027.
Household isolation
Your data is scoped to your household. Postgres row-level security enforces that scope in the database for your estate plans and Tembo memory, and we are extending it to every table.
Planned
Not built yet. We will move each item up when it ships.
- Multi-factor authentication (TOTP) and passkeys.
- A dedicated KMS key per household.
- Executor break-glass access.
Tembo and your data
Tembo's memory is assembled on our servers from your household's Postgres data, isolated with row-level security so one family never sees another's facts. We do not use provider-side memory threads or vector stores. You can review, correct, forget, or pause what Tembo remembers at any time under Settings → Tembo memory. Tembo educates and organizes — it does not give legal advice.