How we protect the sensitive estate, financial, and personal information that executors and their attorneys entrust to us.
Every connection to EstateProFiler — web pages, API calls, and file transfers — is encrypted with TLS 1.2 or higher. TLS certificates are automatically managed and renewed; the application is not reachable over unencrypted HTTP.
Account passwords are hashed with bcrypt, an adaptive, salted hashing algorithm designed to resist brute-force attacks. Plaintext passwords are never stored, logged, or transmitted to third parties, and cannot be recovered — only reset.
API keys, signing secrets, and database credentials are stored in server-side environment configuration — never in client-side code, never in the browser, and never committed to source control.
Sessions are carried in httpOnly cookies that JavaScript cannot read, which neutralizes the most common session-theft vector (XSS token exfiltration). Cookies are flagged Secure in production so they are only ever sent over HTTPS.
Access tokens expire after 15 minutes and are silently rotated using a 7-day refresh token. When a password is reset, all existing sessions are invalidated server-side, immediately signing out any device that held the old credentials.
Users may authenticate with their Google account via OAuth 2.0. In that flow no password exists on EstateProFiler at all — identity is verified by Google and only the resulting verified email and name are stored.
Password-based accounts can enable TOTP two-factor authentication using any standard authenticator app (Google Authenticator, Authy, 1Password). When enabled, a valid time-based code is required after the password before any session is issued, and one-time backup recovery codes (stored only as bcrypt hashes) are provided for account recovery. Recommended for executors administering high-value estates.
Authentication endpoints are rate-limited. Repeated failed sign-in attempts are throttled both per account and per source address, and the same protection is applied to registration and to password-reset requests — sharply limiting credential-stuffing and password-guessing attacks.
Password resets use single-use, expiring tokens delivered to the account email. Reset links cannot be replayed once used, and completing a reset invalidates every existing session across all devices.
Every API request is verified against the requesting user’s identity. A user can only read or modify an estate they own or one they have been explicitly invited to. There is no cross-tenant visibility of any kind.
Estates support three roles — Owner, Co-Executor, and Viewer — granted only through email invitations that the recipient must accept. Only the estate owner can change collaborator roles or revoke access, and invitations sent to one email address cannot be accepted by another.
Attorneys and heirs can be given read-only share links that are time-limited (1–365 days, 90 by default), revocable at any time, optionally password-protected (with a minimum length and the password itself bcrypt-hashed, submitted via a request header rather than the URL, and rate-limited against guessing), and restricted to only the sections the owner chooses to expose. Every access is counted and links return a permanent “expired” response once revoked.
Bank account linking is performed through Stripe Financial Connections. The account holder enters their banking credentials directly into Stripe’s secure interface — those credentials are never seen, transmitted through, or stored by EstateProFiler. Stripe is PCI-DSS Level 1 certified (the highest level) and SOC 1 / SOC 2 audited.
From a linked bank account we store only the institution name, account nickname, last four digits, balance, and the individual transactions the executor explicitly reviews and approves for import. Linked accounts can be disconnected at any time, which also severs the connection at Stripe. A checkout or payment session can only ever be applied to the account that initiated it.
Subscription payments are processed entirely by Stripe. Card numbers are entered on Stripe-hosted payment pages and are never stored on, or transmitted through, EstateProFiler servers.
Administrative functions are limited to a small, explicitly allowlisted set of accounts. Requests to administrative endpoints from any other account return “not found” rather than “forbidden” — a defense-in-depth measure that avoids even revealing that the endpoints exist.
Every administrative action (account changes, refunds, data corrections) is recorded in a dedicated audit log with the acting administrator, the action taken, and a timestamp.
Each estate maintains its own activity timeline recording who created, modified, imported, or deleted each record and when — useful both for probate accountability and for security review.
EstateProFiler runs on managed, containerized cloud infrastructure (Kubernetes) with the database isolated from public access. Application traffic reaches the platform only through the TLS-terminating ingress layer.
The API only accepts browser requests from our own known application domains (an allowlist), rather than any origin. This closes off cross-site request abuse from untrusted websites.
Uploaded documents and attachments are validated by extension, stored with a server-determined content type (never the value a client claims), and served with download-forcing and no-sniff headers so an uploaded file can never be executed as a script in the browser. Downloads are private and access-controlled to the estate.
Transactional and follow-up emails are delivered through Resend (SOC 2 Type II). All marketing sequences honor one-click unsubscribe (RFC 8058) and CAN-SPAM requirements, and unsubscribe requests take effect immediately.
The complete cash ledger exports to CSV and all reports export to PDF at any time — the estate’s records are never locked inside the platform.
Linked bank accounts can be disconnected instantly by the account holder. Full account and estate data deletion is available on request and removes the estate and all of its child records.
Estate data is used solely to provide the service to the account holder and their invited collaborators. It is not sold or shared with advertisers.
Our most sensitive workloads — payments, bank credentials, identity, and email — run on independently audited infrastructure.
Stripe
Payments & bank connections
Handles all card payments and all bank credential entry. The highest level of payment-industry certification.
Optional sign-in (OAuth 2.0)
Users who choose Google sign-in are authenticated on Google’s certified identity infrastructure — no password is ever stored with us.
Resend
Email delivery
Delivers transactional and lifecycle email on audited infrastructure.
EstateProFiler itself does not yet hold an independent SOC 2 or ISO 27001 certification — those attest to company-wide audit programs and we believe in being straightforward about that. What we can demonstrate today is the concrete set of technical controls documented above, plus the certifications of the audited infrastructure partners that handle our most sensitive workloads (payments, bank credentials, identity, and email). We are happy to complete your firm’s vendor security questionnaire with specific, verifiable answers.
Download the print-ready overview to file with your vendor records, or send us your firm's security questionnaire — we answer with specific, verifiable detail.