Data Protection

Your EverKeep vault can include sensitive information such as:

• Names, email addresses, and phone numbers.
• Insurance policy details, including carrier, policy number, coverage amount, and beneficiaries.
• Uploaded policy documents and related files.
• Activity logs and invitation records.

We treat all of this as high-sensitivity data and apply the controls described below to every record.

• In transit: all traffic between your browser and EverKeep is encrypted with TLS 1.3.
• At rest: data stored in our database and object storage is encrypted using AES-256.
• Backups: database backups are encrypted and stored with the same standards as production data.

You control who can see your vault. By default, only you can access your records. When you invite a beneficiary, co-owner, or agent, they can see only the records you assign to them. You can revoke that access at any time.

Behind the scenes, EverKeep uses row-level security policies so that the database itself enforces these boundaries, not just the application layer.

EverKeep uses Lovable Cloud, which runs on managed infrastructure hosted in AWS US data centers. Our payment processor, Stripe, stores billing data under its own security program. We do not store your full payment card number.

• We keep your account data for as long as your account is active.
• When you delete your account, we remove your personal data within 30 days, except where we are required to retain it for legal, tax, or security reasons.
• Aggregated, non-identifying analytics may be retained longer for product improvement.

You can, at any time:

• View and edit the information in your account.
• Export your policy data in a portable format.
• Revoke access from anyone you previously invited.
• Delete your account and all associated data.

To exercise these rights, email us at support@geteverkeep.com.

We rely on a small number of service providers to run EverKeep. Each is contractually required to handle data only as needed to provide their service and to maintain appropriate security controls. Key providers include:

• Lovable Cloud / Supabase — database, auth, and storage infrastructure.
• Stripe, Inc. — payment processing.
• Cloudflare — edge network, DDoS protection, and web application firewall.

We may update this Data Protection page as our practices evolve. If we make material changes, we'll notify you by email or in the app before they take effect.

Questions about data protection? Email support@geteverkeep.com.