Security
How we protect your family's data
You are trusting us with your calendar, your money, and your children's details. Here is exactly what we do to keep that safe, in plain language.
Your data is encrypted, always
Everything you send us travels over an encrypted connection. Our database is encrypted at rest, and every file you upload is encrypted in storage. That applies to documents, photos, and receipts alike.
We never see your card or bank login
Payments run through Stripe, so card numbers never reach our servers. When you connect a bank, you sign in with your bank directly through Stripe Financial Connections and we receive a secure token, never your username or password.
We watch the system around the clock
Automated threat detection and vulnerability scanning run continuously across our infrastructure. A web application firewall filters traffic before it reaches us, and monitoring alerts us the moment something looks wrong.
Access is locked down
Credentials live in a dedicated secrets vault, never in our code. Every administrator account requires multi-factor sign in, across our cloud and email accounts.
Your data is backed up daily
Production databases are backed up automatically and kept for 30 days, with point-in-time restore. If something goes badly wrong, we can put your household back the way it was.
Children get real accounts, with a parent in charge
A child's account can only be created by a guardian in the household, and a guardian manages it. We collect the minimum we need for a child to use their own device.
Where we are with compliance
We are building toward SOC 2 Type 2. We use a compliance platform to monitor our controls continuously, and we are working through the requirements rather than claiming a certificate we have not earned yet. When we complete the audit, we will say so here.
Digital Family Home is available in the United States. Your data is hosted in secure data centers in the United States.
Responsible disclosure
Report a Vulnerability
Found a security issue in Digital Family Home? We welcome reports from security researchers. Submit it below and track it with a private reference code.
Vulnerability Disclosure Policy
Safe harbor
We will not pursue legal action against researchers who act in good faith, follow this policy, and avoid privacy violations, data destruction, or service disruption.
In scope
The Digital Family Home web app, admin, and public APIs (digitalfamilyhome.com and its subdomains).
Out of scope
Denial-of-service, social engineering, physical attacks, spam, and automated scanner output without a demonstrated impact.
Please do
Report promptly, give us reasonable time to remediate before public disclosure, and only interact with accounts you own or have permission to test.
No bug bounty
We do not currently offer monetary rewards, but we genuinely appreciate your help and will keep you updated on the fix.
