Security
Built for the paper that matters.
Passports, tax returns, medical records and the deed to the house. Who can open them, what Thaw's AI is given, where they are stored and what deleting does, in enough detail to check.
Master key · in a separate key service, never on our servers
Your account's key
This document's key
Passport, Rachel
Your documents
Who can read your documents
Each document is encrypted with its own key. That key is encrypted with a key for your account, and the account key is encrypted with a master key that is held in a separate key service and never leaves it. When the app needs to open a document, it sends the encrypted account key to that service and gets the unlocked key back for the length of the request. Every one of those requests is logged.
Someone who copied our storage would have encrypted files and encrypted keys, and no way to open either. There is no screen at Thaw that shows a document, a title or a fact; the staff pages show counts, costs and members' email addresses.
What Thaw's AI is given
To file a document, Thaw is given that document, the kinds of document it knows, and the names already in your household. To answer a question, it is given only the passages that match, with identifying numbers blanked out first.
Reading a document and training on a document are two different operations, and Thaw only does the first. The page goes to the AI service with the question, the answer comes back, and nothing of the page stays behind. Training is a separate process, set up and run on data gathered for it. Thaw does not run it, and our contract with the AI provider stops them from running it on anything Thaw sends.
The AI service holds what it was sent for 30 days at most and then deletes it. All providers are listed in our privacy policy.
The numbers that identify you
Social Security, account, policy, license and VIN numbers are stored encrypted. Beside each one is a scrambled fingerprint that matches only the exact value, so a search for a number finds the document without the number being stored in plain text anywhere.
Before a page's text is indexed for search or sent to answer a question, those numbers are replaced with blanks.
When you delete something
Deleting a document destroys its key in the same request. From that moment nothing running at Thaw can read the file. Our backups keep their copy of the key for up to seven days and then it is gone from those too, and the encrypted file itself ages out of storage within five weeks. Deleting your account destroys the account key the same way, and every file and record in the account is removed within 24 hours. Backups follow on the same seven-day and five-week schedule.
Your account
Signing in
There are no passwords. Sign in with a passkey (Face ID, Touch ID, Windows Hello or a security key), with Google or Apple, or with a link sent to your email that works once and for 15 minutes. Every signed-in device is listed in Settings and can be signed out from there. Repeated attempts from one address or one network are slowed down.
Between one family and another
Every record carries the account it belongs to, and the app only ever asks for records in the signed-in account. Underneath the app, the storage system enforces the same rule on every table on its own, in a way the app cannot switch off: a request from one account for another's records returns nothing. A test of that rule runs on every change we ship.
The record of every access
Every sign-in, view, download, share, correction and key operation is written to a log that can only be added to. Each entry carries a fingerprint of the entry before it, so a changed or removed entry would show. The log is kept for the life of the account and comes with your export.
The two links that work without signing in
The email-in address your scanner sends to, and the calendar link that puts Up next in Apple, Google or Outlook Calendar, work without signing in, because scanners and calendars cannot sign in.
Each one is long and random, belongs to one family or business, and can be replaced from Settings in one click. The calendar feed carries titles, dates and what to do, never an identifying number. Treat both of them like a password.
How Thaw runs
Where it runs
On Amazon's cloud in the United States, in a private network with one guarded way in. Backups run continuously, and every version of an original is kept, so nothing we run can remove a file before its time. Every file is scanned for viruses on arrival; an infected file is held apart and never sent back out, to you or to anyone you share with.
Getting your documents out
Settings builds an export on request: the originals in folders named the way Thaw names them, every fact and link as a spreadsheet and a machine-readable file, the people & things, and the full log. The archive can be downloaded for seven days through a short-lived link, then it is removed. Nothing in it is encrypted or blanked, because it is yours.
Or keep a live copy in your own Google Drive or Dropbox folder, updated as documents arrive.
Reporting a security problem
Security reports go to hello@thawed.app and are acknowledged within two business days. The same address is published at /.well-known/security.txt.
SOC 2 Type I is in progress. HIPAA does not apply to a person storing their own records; medical documents are treated as sensitive anyway.
Common questions
Will Thaw ever sell my data?
No. Thaw is paid for by subscriptions. Your documents and the facts in them are never sold, rented or used for advertising, and nobody sees them but you and the people you invite.
Can Thaw staff see my documents?
No. There is no screen at Thaw that shows a document, a title or a fact; the staff pages show counts, costs and members' email addresses. Opening a document needs the separate key service, and every request to it is recorded.
Are my documents used to train AI?
No. Reading a document and training on a document are two different operations, and Thaw only does the first. Training is a separate process that Thaw does not run, and our contract with the AI provider stops them from running it on anything Thaw sends.
If I delete a document, is it really gone?
Yes. Deleting destroys the document's key in the same request, so nothing running at Thaw can read the file again. Backups keep their copy of the key for up to seven days, then it is gone from those too.
What happens to my documents if I stop paying?
Nothing is deleted. Cancelling keeps every document and drops the account to Free once it fits Free's 250 documents; until then it stays on the paid plan. You can export everything and delete the account whenever you want.
What happens when I delete my account?
The account key is destroyed first, then every file and record in the account is removed within 24 hours. Backups keep their copies for up to seven days for the keys and five weeks for the encrypted files. You get an email when the account is gone.
Something we have not covered?
Write to us. Security questions get an answer from the people who built Thaw.
Free forever: keep 250 documents, with 25 understood in full. No card to enter.