Security at FamilyLockbox
Your family's most important information — financial accounts, legal documents, insurance, identity details — deserves more than a password-protected spreadsheet. Security isn't a feature we added to FamilyLockbox. It's the foundation the whole product is built on. Here's exactly how we protect what you trust us with.
Zero-knowledge encryption
We can't read your data — and that's by design
FamilyLockbox uses end-to-end encryption. Your information is encrypted on your own device, using a key derived from your password, before it ever reaches our servers. What we store is unreadable ciphertext.
That means no one at FamilyLockbox can see your data — not our employees, not our support team, not our database administrators. Even if someone obtained a copy of our entire database, they would find nothing but scrambled text they cannot unlock. This is often called a zero-knowledge design: we hold your data, but we have zero knowledge of what's in it.
The honest version
What this means for you
Because your password is the key, and we never see it, you are the only one who can unlock your vault. This is the point — but it comes with a responsibility we want to be upfront about:
- When you create your account, we give you a 24-word recovery key. Write it down and keep it somewhere safe.
- If you forget your password, that recovery key is how you regain access.
- If you lose both your password and your recovery key, your data cannot be recovered — not even by us. We can't reset what we can't read.
We think that's the right trade-off for information this sensitive. A company that can recover your data on demand is a company that can also read it — and be compelled to hand it over. We chose not to have that power.
The technical safeguards
Layered protections that guard your account and everything inside it.
Strong encryption
Your data is protected with AES-256 encryption — the same standard used by banks and governments — with keys strengthened using industry-standard key-derivation designed to resist brute-force attacks.
Two-factor authentication
Add a second lock to your account with an authenticator app, so a password alone is never enough to get in.
A deliberate choice: we don't offer text-message (SMS) 2FA. SMS codes can be intercepted — through SIM-swap attacks, where someone tricks a mobile carrier into transferring your number, or by exploiting weaknesses in the phone networks themselves. Because these codes travel outside our protection and have well-documented vulnerabilities, we support only authenticator-app 2FA, which generates codes directly on your device and never transmits them.
Protection against automated attacks
Login and account-recovery attempts are rate-limited and shielded by bot protection (CAPTCHA), which blocks the automated password-guessing attacks that compromise most accounts.
Strong password requirements
We enforce a 12-character minimum with mixed character types and check new passwords against databases of known-leaked passwords, so you can't unknowingly reuse a compromised one.
Session protection
Change your password and every other device using your login ID is automatically signed out. Sessions time out after inactivity, so an unattended screen doesn't stay unlocked.
Controlled family sharing
When you invite family members, access is granted through encrypted key-sharing — each person's access is cryptographically scoped, and permissions are enforced at the database level, not just in the app.
Continuous monitoring
Security-relevant events — logins, password changes, recovery attempts — are logged to a tamper-evident audit trail so unusual activity can be detected and reviewed.
Hardened infrastructure
FamilyLockbox runs on enterprise-grade cloud infrastructure with physically secured data centers and continuous monitoring. Data is encrypted in transit (TLS) and again on your device before storage — so your protection never depends on any single provider. Our infrastructure credentials are never stored in our source code.
Responsible disclosure
We welcome reports from security researchers. If you believe you've found a vulnerability, please email us and we'll respond promptly. We ask that you give us a reasonable opportunity to address the issue before public disclosure.
security@familylockbox.comFor security professionals
A detailed technical description of our encryption model, key hierarchy, and security controls is available on request for evaluators, partners, and researchers.
Request documentation