Skip to main content
Estateur

Security & privacy

Estate planning documents contain some of the most sensitive personal information you own: family composition, asset details, healthcare wishes. Here is exactly how Estateur protects it.

Field-level encryption for sensitive identifiers

Social Security Numbers and other sensitive personal identifiers are encrypted with AES-256-GCM before storage. The encryption key is separate from the session secret and never logged.

Encrypted session cookies

Sessions use signed JWTs stored in an HttpOnly, Secure, SameSite=Lax cookie named est_session. The cookie is inaccessible to JavaScript and only transmitted over HTTPS.

TLS 1.2+ in transit

All data between your browser and Estateur's servers is encrypted with TLS 1.2 or higher. There is no unencrypted HTTP pathway to the application.

MongoDB Atlas encryption at rest

All data stored in the database, including your estate planning facts, vault documents, and account information, is encrypted at rest by MongoDB Atlas using AES-256.

Vault documents stored encrypted

Files you upload to the document vault are stored as encrypted Binary data within MongoDB Atlas. They are served only to authenticated users who own the document, or to recipients you have explicitly shared a link with.

Password hashing with bcrypt

Passwords are never stored in plaintext. They are hashed using bcrypt with a cost factor of 12 before storage. We cannot recover your password, only reset it.

Anthropic enterprise data terms

Your estate planning facts are transmitted to the Anthropic API over an encrypted connection for document drafting. Under Anthropic's enterprise terms, your data is not used to train AI models.

Railway hosting

Estateur runs on Railway, a cloud platform with network isolation, automatic TLS, and infrastructure-level DDoS protection. Application logs do not contain user PII.

What we don't do

  • We do not sell, rent, or trade your personal information.
  • We do not use your estate planning data to train intelligent systems.
  • We do not store credit card numbers. Payments are processed by Stripe.
  • We do not send marketing emails without your explicit opt-in.
  • Analytics tools (Google Analytics and the Meta advertising pixel) receive only page-view and conversion events, never the contents of your estate-planning documents or intake answers.

Report a security concern

If you discover a potential security vulnerability or have concerns about how your data is being handled, please contact us immediately at contact@estateur.com. We take all security reports seriously and will respond within 24 hours.

For full details on data collection, retention, and your rights, see our Privacy Policy. Estateur is a self-help document preparation service, not a law firm.