Security
Plain statements about who can read what.
This page describes how EverHandover is designed, without slogans. It also lists what it cannot promise.
Who can read what
- Pointers and instructions (standard content)
- You. Each recipient, after release, for their own handover only. EverHandover holds the encryption key under strict controls so that it can release this content; staff access is limited to stated reasons and is logged.
- Documents and sensitive notes (sealed content)
- You. Each recipient, after release. EverHandover alone cannot read them.
- A death certificate submitted with a report
- The staff reviewers deciding that case. It is deleted afterwards; only a fingerprint of the file and the reviewers’ notes are kept.
- Your recipients’ handovers
- Reviewers and support staff are not given handover content. Reviewers see the case; support sees account details.
Sealed content
Documents and sensitive notes are encrypted in your browser before they are stored. Opening them needs any two of three key parts.
EverHandover’s part
Released only when the conditions you set have been met.
The recipient’s part
Created on their own device when they join.
A backup part
A printed card, or a second person you name. It is never given to the recipient of the same handover.
Account security
- Sign-in by a link sent to your email; there is no password to reuse or leak.
- A second factor from an authenticator app, with recovery codes.
- A fresh second-factor check before sensitive actions, such as signing your disclosure instruction.
Access control and data minimisation
- You choose every recipient and exactly what each handover contains.
- A recipient sees only their own handover, and only after release.
- No passwords, full account numbers or Social Security numbers are accepted.
- Until a person joins, EverHandover stores only the label you gave them. They enter their own contact details.
- Your handover data is not sold, and the app has no advertising or tracking tools.
Data protection and operations
- Encryption in transit for all traffic.
- Stored plan content is encrypted by the application, in addition to the hosting provider’s own protections.
- Releases are carried out by a separate, more restricted part of the system than the website you sign in to.
- Changes to plans, cases and releases are written to an append-only audit record.
- Staff sign in separately from customers, with their own second factor.
- Error monitoring is set to collect as little as possible, with no session recording.
Release safety
- Silence alone never releases anything: not inactivity, not a missed check-in, and not a failed or expired payment.
- Only a person you named can start a release, by a report or a request.
- You are notified on every channel, and can stop the process.
- A death release needs a waiting period, no objection from people you named, and two staff reviewers confirming that the procedure was followed.
Your data
- You can change, re-arm or revoke any handover at any time.
- You can export your plan, keep a printable copy, and close your account.
- How long each kind of record is kept will be set out in the privacy notice.
Important limitations
- No online service can promise that it will always be available, or that it can never be breached. EverHandover should not be the only copy of anything important.
- EverHandover follows the procedure you set. It cannot promise that a document or statement submitted to it is genuine.
- Recipients change phone numbers and email addresses, and institutions change their processes. A plan is only as good as its last review.
- EverHandover holds no security certifications. An independent security review is required before the first customer plan is stored.
Start with one person and one handover.
Add someone who matters, write down what they would need, and see exactly what they would receive.
Create your planEverHandover is not a law firm, does not give legal advice, and is not a will.