🛡️ Security Architecture

Security & Privacy

finilog was designed around an uncompromising principle: your most sensitive information must remain absolutely protected throughout your lifetime – yet remain reliably recoverable by authorized heirs when it truly matters.

Our Security Philosophy

Most digital inheritance systems force users to make a painful compromise between convenience and true security. Passwords or documents often sit in plaintext on third-party servers.

finilog breaks this paradigm. We combine cutting-edge client-side encryption standards with smart, decentralized recovery mechanisms into a single platform that guarantees maximum protection without the complexity.

🧠

Zero-Knowledge

We have zero mathematical or technical means to access your data. Your password is the sole key.

Our Core Principles

🔒

Zero-Knowledge

All confidential data is encrypted before it leaves your device. Our servers never see your real files or passwords.

👁️‍🗨️

Privacy by Design

Privacy is not an afterthought or a feature; it is the architectural baseline of every single line of code.

🇪🇺

European Sovereignty

Our strategic goal is a 100% European infrastructure – for maximum independence and the strictest GDPR enforcement.

🤝

Secure Handover

Reliable transfer of assets to legitimate beneficiaries without ever weakening cryptographic security beforehand.

🔓 Open Source

100% Transparency through Open-Source

Trust is good, mathematical verifiability is better. That is why the entire finilog frontend will be published as open-source software. Every single component responsible for encryption and decryption is completely transparent.

This allows independent security researchers, cryptographic experts, and you yourself to verify at any time that your data is protected exactly as promised. There are no hidden backdoors at finilog whatsoever.

finilog-client-crypto.ts

// Client-side encryption engine

const salt = window.crypto.getRandomValues(new Uint8Array(16));

const vaultKey = await deriveKey(password, salt);

// AES-GCM 256-bit encryption on your device

const encryptedData = await crypto.subtle.encrypt(

{ name: "AES-GCM", iv: iv },

vaultKey,

rawData

);

// Plaintext data NEVER hits the server

Security Architecture Overview

👤
1. User Inputs Data
🔐
2. Client EncryptionAES-GCM-256
☁️
3. Secure Transport Ciphertext only
🧬
4. Status Verification
5. Heir Recovery

Heir Recovery Without Shared Secrets

Every heir gets their own keypair – no password or secret is ever shared between you and your beneficiaries. Your entries are individually encrypted for each heir, directly to their own public key.

👤

Vault Password

Decrypts your own vault. Backed by a one-time generated, printable Recovery Kit code – not a second password to remember.

🏢

Heir Keypair

Every heir with a finilog account gets a personal keypair, protected by their account password, optionally a Passkey, and their own paper Recovery Kit code – any single factor is enough.

👨‍👩‍👧

finilog Release

Access is never granted by a password or paper code alone. finilog must first independently confirm the inheritance case and complete the waiting period.

🎯 For Heirs Without Their Own Account

Anyone who doesn't want to create a finilog account instead receives a printed access code. That code alone is never enough on its own – access only becomes possible together with an independent release triggered by finilog once the waiting period has passed.

Security Features

🔑 Account Protection

  • Multi-Factor Authentication (MFA)
  • Passkeys (WebAuthn) protecting each heir's personal key
  • Real-time Login Notifications
  • Advanced Session Management
  • Proactive Device Monitoring

💾 Data Protection

  • Client-side AES-GCM 256-bit encryption
  • End-to-end encrypted file storage
  • Strict cryptographic key separation
  • Immutable access auditing logs
  • Mathematically secured recovery procedures

Infrastructure Roadmap

Phase 1 – Concept Validation

Initial deployment leveraging established global networks (Cloudflare) to scale while strictly maintaining client-side Zero-Knowledge encryption.

Phase 2 – European Sovereignty

Strategic Goal

Complete migration of all servers, databases, and core infrastructure components to purely European hosting providers for ultimate digital sovereignty.

Phase 3 – Hardening & Audits

Conducting deep, independent security reviews, penetration testing, and continuous code audits by expert external security firms.

Threats We Aim to Mitigate

🎣

Phishing Protection

By utilizing WebAuthn and Passkeys consistently, social engineering attacks fall flat.

💻

Server Infiltration

Even in the event of a full server breach, attackers only capture meaningless ciphertext chunks.

🔓

Data Exposure Leaks

Accidental cleartext exposure is impossible since we never hold your private keys at any point.

Trust Is Earned Through Absolute Openness

finilog operates with 100% transparency. We believe that a true digital legacy can only be built on a foundation of absolute trust. That is why we fully disclose our architecture, encryption workflows, and operations, ensuring you know exactly how your family's future is being protected.

Security Is Not A Feature

It is the foundation upon which finilog is built.

Create Your Secure Vault