Security & privacy
Security is the first thing most people ask us about, and it should be. It is also the first thing we thought about. Before we built a single feature, we worked out how to protect what you would keep here, and that thinking sits at the center of everything incase does. Below are the questions we hear most, answered plainly. Where it helps, the technical detail is one tap away.
Our standards
Every one of these is a choice, and one we intend to keep making. Each goes to the fuller answer below.
There is no password to steal. incase never asks you to make one. To sign in, you type your email and we send you a code that works once and then expires. Nothing to guess, nothing to reuse from some other website’s breach, nothing a scammer can trick out of you over the phone.
Passwordless sign-in with one-time email codes, through Auth0. The system holds no passwords anywhere, so a database leak exposes none.
We took a stronger path. Multi-factor authentication exists to prop up passwords, and the password is the weak link it is trying to protect. incase has no passwords at all, so there is nothing to prop up. You sign in with a one-time code, and a sign-in from a device we do not recognize has to be approved from one you already trust. That gives you what MFA reaches for, without the password that made it necessary.
One-time email codes plus deny-first device trust. Your account is anchored to the devices you actually hold, which is the one factor a remote attacker cannot supply.
Your email alone will not get them in. incase learns the devices you actually use. A sign-in from a phone or computer we have never seen is stopped at a verification screen, and it stays locked until you approve it from a device you already trust. Your laptop can approve your phone, and your phone can approve your laptop.
Deny-first device recognition. An unrecognized device is held with no access and must be approved from a trusted one, rather than being let in with a warning email sent after the fact. Devices are remembered by a private random key, not a browser fingerprint, so privacy settings never break it.
You can still get back in, and a stranger still cannot. We recover your account through things only you would have: approval from another device you trust, a vouch from someone you have shared a Case with, or a call with a real person on our team who confirms it is you. No backup codes to lose. No security questions a stranger could look up the answers to.
Recovery escalates through channels that get progressively harder to fake, ending in human verification that reads only non-sensitive account details, never your Case content. A human check cannot be run against thousands of accounts at once, the way an automated form can.
We built incase so a break-in gives up as little as possible. Your most sensitive details, like a Social Security number, a bank account, or the code to your safe, are scrambled one by one before they are ever saved. And every file you upload, every document, every photo, every recording, is encrypted too, in transit and at rest. Someone who copied our entire database would find gibberish where the values and the files should be.
Application-level encryption on the sensitive fields, on top of encryption in transit and on disk. Uploaded files are encrypted before they ever reach storage and served back only through authenticated requests. The keys are kept separate from the database they protect.
Only the people you invite, and only the parts you choose. You can share your medical folder with your sister, give your spouse everything, and keep the rest to yourself. You control it down to the category, who can view and who can edit, and you can change it whenever you want. You can pull an invitation back before it is accepted, or remove someone’s access afterward. We never sell your information. We never show it to advertisers. There is no tracking pixel feeding you into anyone’s ad machine. And nothing inside your Case is ever sent to an AI to read. It is private until you decide otherwise.
Per-person, per-category, per-action permissions, all revocable at any time. Asking for something you are not allowed to see returns nothing at all. No third-party advertising or analytics trackers run on Case pages, and search runs on our own server with plain word matching, never an outside AI. Learn more about how sharing works.
Almost no one, and that is on purpose. incase is built and run in-house, so no outside developers, agencies, or contractors can touch the code or the systems behind it. No third party has access to what is in your Case. And the tools our own team uses for support work only from basic account details, not your Case content. Reading anything sensitive takes encryption keys that are held very closely, and nothing in our system is built to let staff decrypt your information at will.
Sensitive fields can be read only with the tier encryption keys, which internal tooling does not carry. Support, customer success, and analytics operate on non-sensitive account metadata, and case content is never decrypted for them.
The incase app uses Face ID to open sensitive screens and to approve new sign-ins. Your phone keeps its trust in the same hardware-protected vault Apple uses for its own most private data. If you lose the phone, no one can walk into your Case.
On iPhone, Face ID guards revealing a sensitive value and approving a new device. It is never the login by itself. The phone’s trust key lives in the iOS Keychain, and signing up and sharing stay on the web, so the app is never a way around your account’s protections.
A recorded voice, or a photo of a handwritten recipe, might live only here, so losing it would be as bad as leaking it. We take a fresh backup every day and keep it in separate storage. We keep older versions of your files, so an accidental delete can be undone. And we put hard stops in front of anything that could wipe data by mistake.
Daily encrypted database backups to independent object storage (written by a read-only account that cannot delete anything), file versioning, and several layers that refuse a destructive change before it can run.
Where we stand on AI
Almost every company you deal with is adding AI to something right now. We went the other way, deliberately.
Nothing you put in a Case is ever sent to an AI to read, summarize, or train on. There is no chatbot here. Search works by matching the words you type against the words you saved, on our own server, the way search worked before all of this. On your iPhone, scanning a prescription label happens on the phone itself, using the chip already in your pocket, and it never leaves the device.
We have nothing against the technology in the abstract. But your mother’s medical history should not become training data so that we can announce a feature. Your family’s information belongs to your family. That is a line we drew early and we are not moving it.
What we skip, on purpose
You will see other companies display security certifications on their homepages. Most of those audits were written for banks and corporate IT departments, and passing one mostly proves that a company documented its procedures properly. It does not make your family safer. If a partner ever needs one from us, we will go and get it.
What we do skip, on purpose, are the things that quietly lock real people out. No security questions. No printed codes to keep track of. No surprise logouts. We build for the daughter who needs her father’s information on the hardest day of her life, and we build to keep everyone else out.
What we do instead
Security is something you keep doing, so here is the actual schedule. Every check below is running today, and we name the tools so you can go and read about them yourself.
On every change we ship
gitleaks
Catches credentials or keys that should never have been committed.
pip-audit
Checks every package we depend on against the public vulnerability database.
bandit
Reads our own code for the patterns that cause security bugs.
Before every release
OWASP ZAP
Probes the running app from the outside, the way an attacker would.
Every week
Dependabot
Brings updates for our Python, JavaScript, and build tooling.
Always on
Cloudflare
Filters hostile traffic at the edge, before it ever reaches us.
Every quarter
A full review
All of the above, gathered up and published on this page.
We show our work
Talking about security is easy, so we hold ourselves to it in the open. Protecting your Case is part of every decision we make, and every change we ship is automatically scanned for known vulnerabilities and exposed secrets before it goes live. New weaknesses appear in the world constantly, so the work never finishes.
Four times a year we step back, audit the whole thing, and publish what we found along with what we changed as a result. Our first report comes out in Q4 2026.
Every layer here exists for one reason. The people you love can reach what they need, and no one else can.