Built so that even we can’t read your documents.
You are being asked to keep your passport, your policies and your family’s paperwork in one place. That is a lot to ask, so this page sets out exactly how it is protected: what happens to a document when you add it, what we hold, what we could never hand over, and what happens on the days something goes wrong.
Maintained by Eterny. It describes controls that are in place today; it is not an independent certification.
What happens when you add a document.
Four steps, and the file is only readable in the first and the last of them – both of which happen on your own device.
On your phone
What we store
- Passport – Anna8f3a·71c0·9db4·2e16
- Home insurance policyc40e·15af·77b9·d302
- Mortgage agreement2b71·ae95·0c38·f6d1
- Will & estate directive9d02·6b4c·e817·30fa
Encrypted on your device. The keys stay on your device. We hold the right-hand column and nothing else.
01
You add the document
The file is read on your own phone or laptop. At this point nothing has left the device.
02
It is locked on the device
The document gets its own key, and that key is locked with a key derived from your account. Both stay on your side.
03
Only the locked version travels
What reaches our servers is ciphertext. We store it and back it up, and we hold nothing that can open it.
04
It opens again only for you
When you view a document it is unlocked on your device. The detection that finds gaps works there too – never on a readable copy of ours.
What protects your data
The controls in place today, in more than one line each.
End-to-end encryption
Content is encrypted on your device using a DEK/KEK key hierarchy: every document gets its own key, and those keys are wrapped by a key derived from your account. We never receive either one.
Zero-knowledge documents
What sits on our storage is ciphertext, in the live system and in every backup. There is no internal tool, admin screen or support flow that turns it back into a readable file.
Multi-factor authentication
A second factor and a device check on sign-in, and again before anything sensitive – granting a trusted contact access, changing recovery settings, exporting the vault.
Secure recovery
A BIP-39 recovery phrase you generate and store yourself, with verification and rate limits on every path that could be used to guess at it.
Tenant separation
Institutional deployments are isolated per tenant, with their own configuration, signals and audit trails. Nothing from the consumer product is visible inside them, and nothing from them reaches it.
Security by design
Least privilege, data minimisation and purpose limitation are built into the data model rather than added as policy – the system is not able to collect what it has no reason to hold.
What we hold, and what we never hold.
The short version of everything else on this page.
What we hold
- The locked version of your files, stored and backed up.
- Your account details and billing, because someone has to be able to log you in and charge you.
- A record of sign-ins and security events, so unusual access can be spotted.
What we never hold
- The keys to your documents. They are derived on your device and stay there.
- A readable copy of anything you upload – not in storage, not in backups, not in logs.
- Your recovery phrase. If we held it, it would not be a recovery phrase.
- Anything sold, brokered or handed to an advertiser. There is no version of Eterny where that happens.
If something goes wrong.
The cases people actually worry about, answered here rather than in a help article you would have to go looking for.
You lose your phone
Sign in on a new device with your recovery phrase and the checks you set up in advance. Our support desk cannot let you in – which is also why nobody can talk their way in pretending to be you.
You lose the recovery phrase too
Then your documents stay locked, including to us. That is the honest cost of an encryption we cannot bypass, and the reason we ask you to store the phrase somewhere real before you need it.
Something happens to you
The trusted contacts you named get exactly what you gave them, under the conditions you set – no more, and not a day earlier than you decided.
You want to leave
Export everything and close the vault. Your files come out in a form you can open without us, and nothing is held back to make leaving harder.
Who is responsible for what
Eterny provides the platform controls. You control your keys, your trusted contacts and what you choose to share. Institutional customers remain responsible for their own environment, access management and regulatory obligations.
Institutional deployments run on the institution’s own client data, inside its own perimeter – nothing from those deployments touches the consumer product, and nothing from the consumer product is shared with institutions.
Certifications & audits
Eterny runs on ISO 27001-certified infrastructure, provided by Wultra. Eterny’s own ISO 27001 certification is in progress. No SOC 2, HIPAA or PCI claim is made on this page.