Security

Data Encryption

Your messages are protected with industry-standard encryption:

• All messages are encrypted at rest using AES-256 encryption
• All connections use HTTPS (TLS 1.2 or newer), and browsers are told never to connect without it
• Encryption keys are held outside the database, in a managed secret store

Multi-Step Verification

How long the switch waits is yours to set, and the default leaves plenty of room:

• By default, three missed check-ins 30 days apart, a 7-day grace period and a final warning with 3 more days to answer (100 days in total) - Settings shows an example timeline starting today, not your account’s actual delivery date
• Trusted contacts (if added) are asked to verify before delivery
• If no trusted contacts are added, delivery happens only after the waiting period ends

Secure Infrastructure

We use enterprise-grade cloud infrastructure:

• Hosted on Google Cloud Platform with SOC 2 compliance
• Passwords are stored only as salted bcrypt hashes, never in readable form
• Automated backups with encryption

What the Encryption Does Not Cover

Delivery happens when you are no longer here to unlock anything, so LaterWill has to be able to decrypt your message on its own. That rules out end-to-end encryption: we do not read your messages, but we will not claim we are unable to. What the encryption does guarantee is that the stored data alone - a database copy, a backup - is useless without the keys, which are kept elsewhere.

Report Security Issues

If you discover a security vulnerability, please report it responsibly to:

[email protected]