How Legacy Lab Secures Your Data
At Legacy Lab, protecting your most personal information is our highest priority.
That’s why we’ve built the app with the same level of security trusted by banks and healthcare providers. From strong multi-layer encryption to strict server protections and device-level safeguards, every layer of Legacy Lab is designed to keep your data private, secure, and only accessible to the people you choose.
The short version: Data is protected on your device, in transit, and on the server, and only you and the people you choose to share with can access it.
Secure Encryption & Key Management
-
All sensitive data is encrypted before it ever leaves your device.
-
Cryptographically secure keys protect your information and are managed with multiple layers of encryption.
-
Keys are never stored in usable form — they’re always encrypted and transformed before storage.
Server-Level Security
- Legacy Lab uses Google’s leading services as its secure backend.
- Access is protected by strict device integrity checks, security rules, and user authentication checks.
- A security firm audited the app-to-server communication and verified its security.
Device-Level Protections
-
Only verified app instances can connect to our servers.
-
On iOS, jailbroken, emulated, and reverse-engineering devices are blocked.
-
iOS File Protection and automatic file deletion guard against local data leaks.
-
Additional defenses include biometric login, code obfuscation, and secure key handling.
Secure External Integrations
- Emails (such as login codes or invitations) are sent with a secure third party, with API keys stored securely.
- RevenueCat (subscriptions) uses platform-specific API keys.
- All external integrations are isolated behind server-side calls to limit exposure.
Additional Safeguards
Data Privacy & Control: You own your data. Only you and the people you choose to share with can access it.
Backups & Recovery: Data is backed up securely to prevent accidental loss while maintaining encryption.
Ongoing Protection: Security isn’t “set and forget.” Legacy Lab continuously monitors, updates, and audits systems to defend against new threats.
Security FAQs
Is my information secure on Legacy Lab?
Yes, we take security seriously. We use advanced encryption and follow industry best practices to safeguard your data. Your personal and sensitive information is protected, and only you and authorized individuals you choose can access it.
How is my information kept secure from bad actors?
Sensitive data is encrypted on your device before it’s ever sent to our servers, so it’s never transmitted or stored in readable form.
Encryption keys are themselves protected by Google’s Key Management Service, which means even our database alone is useless to an attacker. Only verified instances of the Legacy Lab app are allowed to connect to our backend, and access to your data is tightly controlled by per-user authentication rules. On the device, we use biometrics, secure key storage, and protections against jailbreaks or tampering.
Have you tested the security features currently in place?
Yes, we’ve had the app independently penetration tested by a third-party security firm for iOS and Android.
What happens to my data if I delete the app or change my device?
Your data is securely stored in the cloud, so you can access it from any device with the app installed and an active subscription.
If you delete the app or change your device, your data remains safe and accessible as long as you remember your login credentials.
Please note: If you delete your profile from the app, all of your data will be deleted from the cloud, and your profile will no longer exist.
Your Security, Our Commitment
We know Legacy Lab holds your most important information. That’s why every decision we make — from app design to server setup — is driven by our commitment to safeguarding your data so it remains secure, private, and accessible only to you and those you trust.
How We Protect Your Information
When you trust an app with the details of your estate, you are trusting it with some of the most sensitive parts of your life and your family’s future: the contents of your will, the accounts your loved ones will need to find, and the wishes you have written for the people you care about most.
That is not the kind of information you hand over lightly, and it is not the kind of information we will ever treat lightly either.
When Andy and I started Legacy Lab, we made an early decision about security. We were not going to assume our own work was good enough. We were going to bring in outside experts whose entire job is to find the things builders miss, and we were going to keep doing that for as long as Legacy Lab exists.
Bringing In Outside Experts
We hired Taylor Banks and his team at LTB Services to assess Legacy Lab. They have now done that work for us twice: once on the iOS version of the app in 2025, and again on the Android version in 2026. Both were hands-on examinations of the actual app, not on-paper reviews.
What We Asked Them to Check
The assessments covered the categories that matter most when an app holds personal information:
- How your data is encrypted, both on your device and as it travels between your phone and our servers.
- How sign-in and two-factor authentication protect your account from unauthorized access.
- The permissions the app asks for on your device, and whether each one is genuinely necessary.
- The outside services connected to the app, including analytics tools, trackers, and third-party software libraries.
- Whether any personal information could leak in unexpected places, such as logs, error messages, or background network activity.
- How your data is stored on your device and on our servers, and what happens to it when you delete it.
- Whether what our privacy policy says is what the app actually does.
Taylor’s team gave us a full written report after each assessment. We worked through it with them, made the changes they recommended, and we plan to keep having Legacy Lab independently assessed as the app grows.
Why We Chose Taylor’s Team
Taylor Banks has spent nearly thirty years working in cybersecurity. He has trained or advised teams at federal agencies including the FBI and NSA, alongside companies like Google and Microsoft. Together, Taylor and his team at LTB Services bring decades of combined experience evaluating how mobile apps handle the data their users entrust to them, and their work has helped shape some of the tools and standards used widely in the security community.
What mattered most to me, though, is Taylor’s reputation for telling clients the truth even when the truth is inconvenient. That is the reason I hired him for the first assessment in 2025, and the reason we brought him back for the second in 2026.
If You See Something, Tell Us
If you are a user, a security researcher, or simply someone who notices something on Legacy Lab that does not look right, we want to hear from you. Please write to [email protected] and describe what you saw, where you saw it, and the steps that would let us reproduce it.
Screenshots are helpful when you can include them. We read every message that comes in; we will follow up with you, and we will never penalize anyone for reporting a concern in good faith. If you are a security researcher and you would like us to credit your work, simply let us know in your message.
Your trust in Legacy Lab is something Andy and I take personally. Protecting it is the part of this work that matters most to us, and it always will.
– Cory Warden, Legacy Lab
Start Organizing Your Legacy Today
Getting started with the Legacy Lab App is easy. Just download, signup, and upload your first document all in the matter of minutes. Need some inspiration on what to include in your digital estate organizer? Check out our resources page for more information and helpful tips for getting started.