Security and proof
What this app guarantees, how it guarantees it, and what it does not guarantee yet.
Inside this app sit conversations, photographs of children, bank statements and documents that may end up in court. Whoever puts that somewhere has the right to ask how it is kept — and to get an answer they can check, not a reassuring phrase.
The chain of custody, step by step
A document is only worth something as proof if you can show it is the same one that came in. There are four moments, and at each one a fingerprint is left.
What comes in is sealed
Every imported file — the WhatsApp export, the operator’s call detail, the e-fatura CSV — is kept intact, as it came, with its SHA-256 digest recorded. That file is what counts as the source; what you see in the app is the copy extracted from it.
The app never writes over the original. When everything has to be rebuilt from scratch, that is what it is rebuilt from.
What is altered says so
A photograph re-encoded to take up less space says that it was re-encoded, with the size and the digest it had before. The camera data is preserved.
A phone number the app inferred is marked as inferred, and never overwrites what the file brought. What the app guessed is never drawn the same as what a person stated.
The activity log is chained
Every sign-in and sign-out, every export, every change of permissions is logged — and each line of the log carries the cryptographic digest of the previous one. Changing a line breaks the link with the next; deleting one does the same.
This does not stop anyone writing in the database: it makes it impossible to do so without it showing, and the check says on which line and on which day the chain breaks.
The document that comes out is signed
Every PDF issued carries a cryptographic signature over its own bytes: change one digit and it stops matching, and that shows in any PDF reader, offline, without depending on us.
And it carries in the footer the address where it is checked, plus the tip of the log chain at the moment it was issued. See the verification page
Why the tip of the chain goes inside the document
It is the part that makes the chained log a proof rather than a statement about ourselves.
On its own, a chain of digests shows that nobody changed a line in the middle. But whoever holds it all could, in theory, rebuild it end to end. What they cannot rebuild are the documents that have already left here and are in other people’s hands.
A report issued in March, held by the other party and the lawyer, fixes what the log said in March. Anyone wanting to rewrite the past would also have to rewrite the papers they no longer hold.
Where the data lives
Servers, and only in the European Union
The servers are in the European Union (Contabo (França), Hetzner (Alemanha), DOTEC (Portugal) e Amazon Web Services (Irlanda)) and we do not transfer data outside the European Economic Area. The subprocessors are named on the privacy policy.
Each family has its own database
It is not separation by a column in a shared table: it is one database file per family and one folder of files per family. A programming mistake in a query cannot show one family another family’s data, because the other family’s data is not there.
It is also what makes it possible to delete a family entirely, and to export it entirely.
Who, on our side, can go in there
We only go in if you ask for support and authorise it, and that entry goes into the chained log — which you can check. We do not read the content for anything else, we do not use it to train anything and we do not sell it to anyone.
Signing in
Password stored as a cryptographic digest, two-factor authentication, and passkeys using the device’s Face ID or fingerprint — which are safer, because there is nothing to steal and they do not work on a fake site.
You see the recent sign-ins to your account and can end all other sessions at once.
When you leave, you really leave
You export everything in one file, in a format that imports elsewhere. After the subscription ends: 7 days in which nothing changes, 90 days with the account read-only so you can reactivate or export, and then we delete the database and the files for good. You can ask for immediate deletion at any time.
We do not keep your records «because they might be needed in a future case». They are yours.
Audio transcription never leaves the server
When it is switched on, transcription of voice messages runs on our own machines and talks to no external service. A voice message from a family argument is not something to send to an AI provider in exchange for a feature.
What we do not do, on purpose
There are features other apps have that you will not find here. Not because they cannot be built — because they would wreck what this app is for.
We do not fix what you write
There is no assistant here that improves the tone of your messages before you send them. In an archive that exists to show what was said, an app that rewrites what you said no longer holds what was said — and that, exactly that, is what someone will ask to read.
We do not locate the other party
The location recorded is that of your own phone, so you can document where you were. We do not have the other person’s phone, we do not want it, and an app offering that would be selling surveillance under another name.
For the same reason, the dossier of an event never says where the other party was — it says what is known and stays silent about the rest. One invention among ten facts throws the ten away.
We do not count email opens as proof
When you send a document to the other party, we keep her mail server’s acceptance — a technical fact, verifiable from the other side — and the clicks on the buttons. OPENS come switched off: Apple Mail loads the images by itself and reports «opened» for someone who never opened it. In a document going to a lawyer, a wrong opening time is worse than no time at all.
And we do not record the IP address of whoever opens or clicks. The other party is not our customer.
We decide nothing for you
An invoice arriving by email waits for confirmation. An instalment the app recognised on its own is marked «to check» and counts for nothing until you say yes. An appointment is never cancelled by it. What the app inferred is always marked as inferred.
What we do not have yet
This section exists so the rest of the page is worth something. These are the questions a demanding technician asks, and the honest answers as of today.
Qualified electronic seal (eIDAS)
The certificate that signs our PDFs is issued by ourselves. That proves integrity — change one byte and the signature fails — and proves the document came out of this app. It is not a QUALIFIED seal issued by an accredited trust service provider.
The difference matters: under the eIDAS regulation no electronic seal may be refused as evidence merely for not being qualified, but it is the qualified one that automatically benefits from the presumption of integrity and of origin. It is in our plans; it is not done.
ISO 27001 or SOC 2 certification
We do not have them. They are expensive, lengthy audits, and saying otherwise would be false. What we can offer in the meantime is something a certificate does not give: the log chain check runs on your side, and verifying a document does not require trusting us.
Penetration test by an independent body
Not yet done by an outside body. When it is, the date and the executive summary appear here.
Encryption of files at rest
It is half done, and it is worth saying which half.
Done. Backups are encrypted before they leave the server, with a key that stays on our side and that the storage provider does not have. And the original files — the export exactly as it came off the phone, the invoice exactly as it was issued, which is the part that carries evidential weight — are kept off the server, also encrypted with our key. Neither is readable by anyone with access to the storage.
Not yet done. The already-processed photos and videos, and the database file, sit on the server's disk and are not yet encrypted by the application. Saying otherwise would be the easiest claim to make and the hardest to defend if anyone went and checked. That is what is missing, and this is how it stays written until it is done.
Voice and video calls inside the app
There are none. This app records and organises communications that happen elsewhere — including those that happened before you installed it — rather than being one more place to talk.
Unlimited storage
No. Storage is part of the plan and you can see at any moment how full it is. We would rather say what it costs to store than promise «unlimited» and then find a way to limit it. See the prices
Track record
We are recent. There are apps in this field with more than twenty years of use in courts, and that is a real advantage that cannot be bought. What we have to put on our side is what can be verified today, from outside, without taking our word for it.
Try it with your own files
It is the only way to tell whether it serves — and you can take everything with you if it does not.