Security
Built to hold what you can't afford to lose
Haven IQ exists to hold medical records, financial paperwork, legal documents, and passwords. That's a responsibility we designed for from the first line of code — in plain English, here's how.
- Encrypted in transit and at rest
- Everything you store is encrypted on its way to Haven IQ and while it lives there, on enterprise-grade cloud infrastructure.
- An extra layer for true secrets
- Vault passwords and household codes get their own AES-256 encryption on top of everything else, and are decrypted only when you ask to see them.
- Sensitive digits, never stored
- Financial account numbers are masked the moment you enter them — Haven IQ keeps the last four digits and the full number is never saved at all.
- Access checked on every request
- Roles and record-level visibility decide exactly who can see what, and every request is verified on our servers — not just hidden in the interface.
- Multi-factor authentication
- Protect your account with an authenticator app, and sign out of every device at once if something ever feels off.
- A record of security events
- Sign-ins, sharing changes, and secret reveals are logged, so there's an answer to "what happened, and when?"
- Documents behind scoped access
- Uploaded files live in private storage and are served through short-lived, permission-checked links — never public URLs.
- The assistant never sees your secrets
- Stored passwords and codes are kept away from the assistant entirely, and nothing it suggests becomes part of your records until you approve it.
Behind the scenes
- Infrastructure
- Haven IQ runs on established cloud platforms — Vercel for the application and Supabase (on AWS) for the database, authentication, and file storage — with TLS on every connection and strict security headers on every response.
- Backups
- The database is backed up automatically by our infrastructure provider, and backups are encrypted like everything else. Backups exist to survive disasters, not to resurrect deleted data — deleted information ages out of them on a fixed schedule.
- Monitoring & audit trail
- Sensitive actions produce structured, privacy-safe log lines (never document contents, passwords, or tokens), and an append-only security audit trail records security-relevant events — one that even we can't rewrite.
- Incident response
- If a security incident ever affects your information, we will investigate, contain it, and notify affected users and regulators as the law requires — plainly, and without burying it.
Found something? Tell us.
We welcome good-faith security research. If you believe you've found a vulnerability, email [email protected] with enough detail to reproduce it. We'll acknowledge your report, keep you informed while we fix it, and never take legal action against research conducted in good faith — don't access other people's data, and give us reasonable time to fix what you find before disclosing it.
Your information is yours
Everything you add to Haven IQ belongs to you. Update it, correct it, share it, or remove it whenever you want — nothing is sold, and nothing is shared beyond the people you choose. The full detail lives in our Privacy Policy. If you have a question this page doesn't answer, contact us — security reports go to the top of the pile.