Security
Everything is locked on your device before it reaches us, and only the people you chose can unlock their part, only after release. Here's how, including what isn't finished yet.
readable
locked
readable, their part only
Encryption
Every entry, file and video is encrypted in your browser using libsodium, a widely used open-source cryptography library. Large files are encrypted in pieces and checked piece by piece when they're opened, so a damaged or swapped file is refused instead of shown.
Your keys
Signing in on a new device takes your password and a Secret Key from the Emergency Kit you print at sign-up. A stolen password alone isn't enough. Your Recovery Key resets a forgotten password; we can't, because we never have the keys.
By default, your browser keeps your Secret Key only until you close the tab. If you tick "Remember my Secret Key on this device," it's saved in this browser's storage instead, where any code running on this site could read it. That's convenient on your own computer, and why it's off unless you choose it.
Sharing
Each entry has its own key. When you name someone, the two of you compare a short code once, so nobody can slip in a fake recipient. After release, each person can open only the entries you gave them.
False alarms
Two weeks of reminders, then two of your three trusted contacts must agree, then a final countdown that you can cancel at any moment. A single "they're fine" from any contact stops it.
Our servers
Even if someone broke into our servers, they'd find only locked copies. On top of that:
Every product like this has them. We'd rather you hear them from us.
Porchlight Plan has been through five rounds of adversarial security review, with every finding fixed or written down. It hasn't had a paid outside audit. Our first revenue pays for one, and until then we won't call it "audited" or "bank-grade."
Because we can't read your binder, we can't recover it for you. Keep your Emergency Kit with your important papers.
Each person you name gets their own key. If they lose it after release, their entries can't be opened. For anything critical, name two people.
Encryption in the browser depends on the page we send you. We keep pages free of outside scripts, lock them down with a strict security policy, and publish a fingerprint of every file so changes can be spotted.
It gives you a new password, Secret Key and Recovery Key and signs every other device out. Anything already opened on the lost device can't be un-seen, so change the most important passwords stored in your binder too.
Email security@porchlightplan.com with what you found and how to reproduce it. Please test only with your own account, don't access or change anyone else's data, and give us a reasonable chance to fix it before telling others. We'll write back and keep you posted.
Our plan for winding down is designed so your people still get what you left them, without our servers.
12 months
Notice to every owner on every channel, with time to export or move.
Time-locked
For owners who don't answer, their people receive a locked key that opens on a set date, using drand, a public, independent network.
No servers needed
After that date, your people open what you left them with their own key and a free, published tool.