Security

Your family's stories are precious. We use enterprise-grade security to keep them safe.

Security First Approach

At Legacy Notes, security isn't an afterthought—it's fundamental to everything we build. We employ multiple layers of security controls, from access management to continuous monitoring and regular audits. Our security practices meet or exceed industry standards, and we're committed to protecting your family memories with the same care you would.

Our Security Measures

Comprehensive protection at every level of our platform

Transport & Storage Encryption

Encryption in transit and at rest using platform-managed TLS and storage/database encryption.

TLS 1.3 on the edge network (automatic SSL certificates & HSTS possible via headers)
Supabase encrypts stored data and managed backups at rest
Signed URLs for secure short-lived storage access
Secure key management via environment variables / secret store

Authentication & Access

Modern auth flows and fine-grained access control using modern auth and database policies.

JWT-based sessions from Auth provider
Row Level Security (RLS) for per-row access policies
Server-side session handling with server components / edge runtime
Service role keys and admin secrets kept out of client bundles (env vars)

Platform & Infrastructure Security

Hosted on industry favorite edge platform with CDN, automatic TLS, and deployment isolation.

Global edge network and CDN for reduced attack surface and faster TLS termination
Automatic DDoS protections and platform-level hardening
Immutable deployments and isolated preview environments
Controlled access to deployment keys and CI secrets

Monitoring, Observability & Incident Response

Visibility across app and database with logging, alerts, and incident workflows.

Realtime logs and metrics from providers
Database monitoring, slow query logs, and WAL-based backups
Alerting for anomalous behavior
Post-incident reviews and remediation process

Data & Access Controls

Principle of least privilege applied to database, storage, and service accounts.

Fine-grained RBAC and RLS for database rows/tables
Short-lived tokens and signed URLs for storage access
Periodic access reviews and key rotation
Audit logging of admin and service actions

Security Best Practices & Compliance

Continuous security hygiene: dependency scanning, audits, and secure CI/CD practices.

Secure build pipeline with secrets injected at deploy time (env vars)
Automated tests and pre-deploy checks for sensitive changes
Adherence to industry controls and documented security processes

Built-In Security Features

Security features built into every aspect of our platform

Automatic logout after inactivity

Email notifications for account changes

Granular privacy controls

Secure file upload

Content moderation and reporting

HTTPS everywhere with HSTS

Security training for staff

Security Best Practices

How you can help protect your account

Use Strong Passwords

Create unique, complex passwords with at least 12 characters including uppercase, lowercase, numbers, and symbols.

Review Account Activity

Regularly check your account activity and report any suspicious behavior immediately.

Be Cautious with Sharing

Only share sensitive family information with trusted individuals and review privacy settings regularly.

Incident Response

How we handle security incidents

In the unlikely event of a security incident, we have a comprehensive incident response plan:

Immediate Response: Security team activated 24/7 to contain and assess incidents
User Notification: Affected users notified promptly as required by law
Remediation: Quick action to resolve vulnerabilities and prevent recurrence
Post-Incident Review: Thorough analysis to improve our security measures

Certifications & Compliance

Our commitment to security excellence

SOC 2 Type II

Audited compliance with security, availability, and confidentiality criteria

GDPR & CCPA

Full compliance with major data protection regulations

Report a Security Issue

If you discover a security vulnerability, please report it to our security team immediately. We take all reports seriously and will respond promptly.

Report Security Issue View Data Protection

Email: security@legacynotes.io • We respond within 24 hours

Security First Approach

Security

Security First Approach

Our Security Measures

Built-In Security Features

Security Best Practices

Incident Response

Certifications & Compliance

Report a Security Issue

Product

Resources

Trust & Safety

Company

Security

Security First Approach

Our Security Measures

Built-In Security Features

Security Best Practices

Incident Response

Certifications & Compliance

Report a Security Issue