Security
Built for the paper that matters.
Passports, tax returns, medical records and the deed to the house. How they are kept, with enough detail to check.
Master key · in a separate key service, never on our servers
Your account's key
This document's key
Passport, Rachel
Who can read your documents
Each document is encrypted with its own key. That key is encrypted with a key for your account, and the account key is encrypted with a master key that is held in a separate key service and never leaves it. When the app needs to open a document, it sends the encrypted account key to that service and gets the unlocked key back for the length of the request. Every one of those requests is logged.
Someone who copied our storage would have encrypted files and encrypted keys, and no way to open either. There is no screen at Thaw that shows a document, a title or a fact; the staff pages show counts, costs and members' email addresses.
When you delete something
Deleting a document destroys its key in the same request. From that moment the file cannot be read, including any copy of it in a backup. Deleting your account destroys the account key the same way, and every file and record in the account is removed within 24 hours, backups included.
The numbers that identify you
Social Security, account, policy, license and VIN numbers are stored encrypted. Beside each one is a scrambled fingerprint that matches only the exact value, so a search for a number finds the document without the number being stored in plain text anywhere.
Before a page's text is indexed for search or sent to answer a question, those numbers are replaced with blanks.
Between one family and another
Every record carries the account it belongs to, and the app only ever asks for records in the signed-in account. Underneath the app, the storage system enforces the same rule on every table on its own, in a way the app cannot switch off: a request from one account for another's records returns nothing. A test of that rule runs on every change we ship.
Signing in
There are no passwords. Sign in with a passkey (Face ID, Touch ID, Windows Hello or a security key), with Google or Apple, or with a link sent to your email that works once and for 15 minutes. Every signed-in device is listed in Settings and can be signed out from there. Repeated attempts from one address or one network are slowed down.
The record of every access
Every sign-in, view, download, share, correction and key operation is written to a log that can only be added to. Each entry carries a fingerprint of the entry before it, so a changed or removed entry would show. The log is kept for the life of the account and comes with your export.
What the AI is given
To file a document, Thaw's AI is given that document, the kinds of document it knows, and the names already in your household. To answer a question, it is given only the passages that match, with identifying numbers already blanked. Nothing of yours is used to train any model. The AI service keeps what it was sent for 30 days at most; the provider is named in the privacy policy.
Where it runs
On Amazon's cloud in the United States, in a private network with one guarded way in. Backups run continuously, and every version of an original is kept, so nothing we run can remove a file before its time. Every file is scanned for viruses on arrival; an infected file is held apart and never sent back out, to you or to anyone you share with.
Also
Two links that work without a sign-in
The email-in address your scanner sends to, and the calendar link that puts Up next in Apple, Google or Outlook Calendar, work without signing in because scanners and calendars cannot sign in. Each is long and random, belongs to one family or business, and can be replaced from Settings in one click. The calendar feed carries titles, dates and what to do, never an identifying number. Treat both like a password.
Getting out
Settings builds an export on request: the originals in folders named the way Thaw names them, every fact and link as a spreadsheet and a machine-readable file, the people & things, and the full log. The archive can be downloaded for seven days through a short-lived link, then it is removed. Nothing in it is encrypted or blanked, because it is yours. Or keep a live copy in your own Google Drive or Dropbox folder, updated as documents arrive.
Reporting a problem
Security reports go to hello@thawed.app and are acknowledged within two business days. SOC 2 Type I is in progress. HIPAA does not apply to a person storing their own records; medical documents are treated as sensitive anyway.
Questions about any of this?
Write to us. Security questions get an answer from the people who built it.
Everything in Family for your first 14 days, then free forever for your first 100 documents. No card to enter.