Security
Sealed in your browser. Unreadable to us.
The safest way to hold something private is to be unable to read it. SuddenGone is built so that what you write is locked before it leaves your device, and only the people you chose can ever open it.
How the sealing works
1 of 6
Your SuddenGone password never reaches us
When you sign in, your browser stretches your password with PBKDF2 (SHA-256, 600,000 rounds) and splits the result into two keys. One is a sign-in key, which is sent to us and stored only as a bcrypt hash. The other is an encryption key, which stays on your device.
2 of 6
The vault key is made in your browser
At sign-up your browser creates 32 random bytes. That is your vault key, and it seals every entry and every file with AES-256-GCM. A password you save for your bank is sealed exactly like a note about your garden. We store the vault key only in wrapped form, locked under the encryption key that never leaves your device.
3 of 6
A recovery code is your spare key
You are shown a recovery code once. It wraps a second copy of the vault key. If you forget your password, the code lets you set a new one and keep your entries. We do not keep the code and cannot make another.
4 of 6
Each person gets an envelope in two halves
For each person you name, your browser wraps the vault key under a key built from two random halves. One half is printed on their card and never sent to us. We hold the other half and release it only after a confirmed passing and the waiting period.
5 of 6
A backup key from something only they know
Cards get lost, and after a sudden death some were never handed over. So for any person you can also set a question only they can answer. Your browser stretches the answer the same slow way it stretches your password and uses it, with a second half that we hold, to wrap another copy of the vault key. The answer itself is never sent to us. It is optional, and you set it person by person.
6 of 6
A card can be checked without being revealed
We keep a one-way fingerprint of each card code. It lets a person prove they hold the right card, in a practice run or before release, without the code itself ever being sent. A fingerprint of 160 random bits cannot be worked backwards.
The two halves
Why a stolen card, or a stolen database, opens nothing.
The key to each person's envelope exists only when both halves meet in their browser. A card alone is a string of letters. Our half alone is a string of bytes. We decide when our half is handed over, and that happens only after a report, a review and the waiting period you set.
Their card
Half of the key, on paper
K7QM-2XVD-PLTA
Kept by the person you chose. Never sent to us.
Our half
Half of the key, held back
Handed over only after a confirmed passing and the waiting period.
Together, the envelope opens
In their browser. Still unreadable to us.
What we can see, and what we cannot
We can see
- Your name and email address
- The names and email addresses of the people you chose
- Your check-in schedule and when you last checked in
- Which section an entry belongs to, how many entries you have and when each was changed
- Your plan and payment status (card details are held by Stripe, not by us)
- A note for your contacts if you write one for going-quiet alerts
- The backup question you set for a person (never the answer)
- Who goes first, who your stand-in is, and which sections each person may receive
- Which entries you marked to be destroyed at release (the mark, not the contents)
- The short notes you leave for people who hold no card. We have to send these, so we can read them
We cannot see
- Any entry: account names, sign-in names, passwords, full numbers, codes, notes, wishes
- Your Social Security number or any other number you save
- Any letter you write or voice message you record
- Any attachment you add
- Your private clean-up list
- Any paper you make. It is put together in your browser, and a saved copy is sealed like any attachment
- The answer to any backup question
- Your SuddenGone password or your recovery code
- The code on any card
If the worst happened to us
What a break-in would expose.
Someone who copied our whole database would get the plain facts listed above, sealed entries they cannot read, wrapped keys they cannot unwrap, and our halves of envelopes that are useless without cards we never had. They would not get a single account name, password, number, letter or document.
We would still tell you promptly, because names and email addresses matter too.
No third-party scripts
No analytics tags, ad pixels, chat widgets or outside fonts run on this site. Payment happens on Stripe's own page.
Passwords are sealed, not stored
The sign-ins, numbers and codes you save reach us already encrypted. To us, and to a thief, they are unreadable bytes.
Nothing to search
We cannot look up an entry by bank, by name or by number, because we cannot read any of them. Search happens on your device, after you open the vault.
Death certificates are deleted
A certificate uploaded with a report is kept only for review and a short period after, then removed.
Your account
Ways to guard the door, on every plan.
An envelope that holds passwords deserves more than a password of its own.
A second step at sign-in
Turn on two-step sign-in and we ask for a six-digit code from an authenticator app before any sealed data is sent to a new device. You get backup codes for the day your phone is not at hand. It is on every plan.
A list of signed-in devices
See every device that is signed in to your account and sign any of them out. We email you when a device we have not seen before signs in.
A vault that locks itself
The key that opens your entries is held only while you are using them. Choose how many minutes of stillness lock the vault, or lock it yourself with one tap.
Secrets stay covered
Passwords, numbers and codes are hidden on screen until you ask to see one. A printed binder leaves them out unless you choose to include them.
Who opens what, and when
The order is yours to set, and we keep to it.
An envelope does not have to open for everyone at once, or with everything in it.
A clean-up list reaches one person only
Your private clean-up list is sealed like every entry, and our servers send it only to the person you chose to go first. It is never part of anyone else's envelope, before or after.
The others wait, but not forever
At release the first person's envelope opens and the rest are held. They open when that person says they have finished, or after the wait you chose, seven days unless you change it. Nobody is left locked out because one person went quiet.
Destroyed means deleted
An entry you mark "never hand this over" stays readable to you. At release it is deleted from our servers, still sealed and unread. It is not sent to anyone.
A stand-in sees only what you chose
If you are alive but unable to act, one person can be shown the sections you picked for that case, after a doctor's letter, a review by a person and a waiting period. Nothing else leaves our servers, the account stays yours, and you can end their access.
Our own staff
What the people who run SuddenGone can do, and what they cannot.
Staff tools sit behind their own sign-in and are never shown to members. They work on accounts, never on what is inside them.
Staff can
- See the plain facts listed above: names, emails, schedules, plan and payment status
- Review a report of a passing and the death certificate sent with it
- Help with an account: confirm an email address, end sign-in sessions, pause alerts, close an account on request
- Review a report that a member is alive but unable to act, and the doctor's letter sent with it
- Look for an account when a family member asks from the "Someone has died" page, and write to the people that member named
- Verify a funeral home or advisor before its reports are accepted
Staff cannot
- Read, search or export anything inside an envelope
- See or reset your SuddenGone password, your recovery code or any card code
- Open an envelope, or hand over our half of a key before a report, a review and the waiting period
- Open an envelope for someone you did not name, or without that person's card or answer
- Sign in as you
Honest limits
What this design cannot do.
No system is perfect, and you should know where the edges of this one are.
If you lose both your password and your recovery code, your entries are gone.
We cannot reset our way into a sealed vault. You could start a fresh one, but the old entries cannot be read by anyone. Keep the recovery code with your important papers.
You are trusting the code this site sends to your browser.
The sealing happens in code we serve. If that code were ever changed with bad intent, it could misbehave. This is true of every web app that encrypts in the browser. We limit the risk by running no third-party scripts at all and by keeping a strict content security policy.
A device that is already compromised is outside our reach.
If someone else controls your computer or phone, they can see what you see. Use a device you trust, keep the auto-lock short, and lock your vault when you step away.
Your SuddenGone password is the lock. Make it a good one.
Two-step sign-in stops a stranger from fetching your sealed data, but the password is what seals it. Use one you use nowhere else, long enough that nobody could guess it.
A backup question is easier to guess than a card.
A card code is long and random. An answer is a word or two a person can remember, so it can be guessed. We limit how many tries a link gets and make each try slow, but someone who stole our database could keep guessing on their own machines. Pick a question whose answer cannot be looked up or found on social media, and that only this one person would know. If you would rather not take the trade, leave it off and rely on the card.
Which sections a person receives is enforced by us.
Every person's envelope wraps the same vault key. When you limit someone to certain sections, or keep the clean-up list to one person, it is our servers that hold back the other sealed entries. We cannot read them, but we are the ones deciding which to send.
We cannot delete anything from a phone or a cloud account.
No outside service can. Private clean-up works because a person you trust goes first with your list and your passcodes. SuddenGone only controls the order in which envelopes open.
Notes to people without a card are not sealed.
A short note to an employer or a landlord is emailed by us at release, so we store it in a form we can read. Keep those notes to what you would put in an ordinary email.
A password is access, not permission.
Having someone's sign-in is not the same as having the legal right to their account. For banks, brokers and insurers, your family should use the firm's own process with a death certificate. Sign-ins are for what that process does not cover: email, photos, the phone, bills and subscriptions, where the service allows it.
Some facts are not sealed.
To email your people and run check-ins, we must be able to read names, email addresses and schedules. The list above is complete.
Found a weakness? Write to support@suddengone.com. We read every report and reply.