Security
Locked on your device. Only you have the key.
You don't need to know anything about encryption to use SECURECORDS. This page explains what happens to your records in everyday words. The technical details are at the end, for anyone who wants them.
The idea in 30 seconds
Imagine renting a storage box, but you put your own lock on it at home before handing it over. We keep the box safe for you, but we never get the key, so we can't open it. Neither can anyone who breaks into our building.
1. Locked at home
When you save a result, your phone or computer locks it first. Only the locked version is sent to us.
2. We store the locked box
Our servers hold your records in locked form. To us they look like random characters.
3. Only you can open it
The key is made from your password, on your own device. We never receive your password or the key.
Questions people ask
If you never see my password, how do you check it when I sign in?
When you type your password, your device turns it into two different codes:
- a sign-in code, which is sent to us. It works like showing your ID at the door. We keep a scrambled copy of it and compare the two when you sign in.
- an unlock code, which never leaves your device. It's the one that opens your records.
The two codes are made so that knowing the first one tells nobody anything about the second. So we can confirm it's you without ever being able to open your records.
Then who unlocks my records?
Your own device does. When you open the app, we send your records to you still locked. Your device uses your unlock code to open them on your screen. Nothing is ever unlocked on our servers.
What if I forget my password?
When you create your account you get a recovery key, a long code that works like a spare key. Keep it somewhere safe, for example printed at home. With it you can set a new password and keep all your records. You then get a new recovery key, and the old one stops working.
We don't keep a copy of your recovery key. If you lose both your password and your recovery key, nobody can open your records, not even us. That's the price of real privacy.
What does a passkey do?
A passkey lets you unlock the app on your own phone or computer with Face ID, a fingerprint or your device PIN, so you don't have to type your password every time. Your fingerprint or face never leaves your device, and we never receive it. A passkey only works on the device where you set it up, and only after you've signed in there with your password. It's optional.
Can SECURECORDS staff look at my results?
No. We don't have your key, so your results are just as unreadable to us as they would be to a stranger. That includes our own team and our hosting company.
What if someone hacks your servers?
They would find locked boxes and no keys. Your records would still be unreadable. They also wouldn't find your password: we never have it.
So what can you see?
Only what we need to run the service: your email address, your plan and billing status, and simple facts about your account, such as how many records you have, how large they are, when they were saved and when you last used the app. We can't see which tests you track, your values, dates, notes, life events, medicines or allergies, or anyone's name, date of birth, sex, height or blood type. Payments go through Stripe, so we never see your card number.
A normal day, step by step
You create an account
Your device makes a brand-new key for your records. It locks that key with your password, and again with your recovery key, which is shown to you once. We receive only the locked versions.
You save a result
Your device locks the result, including the value, the date, your notes and even which test it is, and then sends it. Each record gets its own seal, so nobody can swap or change it without the app noticing.
You sign in on another phone or computer
You type your password. We check your sign-in code and send back your locked key. Your new device opens it with your password and can then read your records.
You step away
The key only exists while the app is open. Closing the tab, signing out, or the automatic lock after a period of no use wipes it from memory.
Other protections
- The app locks itself when you're not using it (you choose after how long)
- Optional passkey unlock with Face ID, fingerprint or PIN
- Changing your password signs out your other devices
- Repeated wrong passwords are slowed down to stop guessing
- New sign-ups need a bot check and an emailed code, and fake or throwaway email addresses are refused
- The sign-in page never reveals whether an email address has an account
- No advertising, no tracking, no analytics companies
- PDF reports are made on your device; nothing is uploaded unless you choose a secure link — and then only in a form we can't open
- Secure links and emergency QR codes expire on their own (7 days at most), can be turned off any time, and are deleted when they do
- Your sign-in only works on this website, not from other sites
- Deleting your account permanently removes all your records
Honest limitations
No system is perfect. We'd rather you know the trade-offs now than be surprised later.
We can't rescue a lost password and recovery key
That's the other side of us never having your key. Keep your recovery key somewhere safe, offline.
Your device matters
Your records are opened on the phone or computer you use. If that device has a virus, your data could be seen there. Keep it updated and locked.
You're trusting our app
Like every website, SECURECORDS runs code sent by our server. The lock is only as good as that code, which is why we describe it openly below.
Some facts aren't locked
Your email address, your plan and billing status, and simple account facts (such as how many records you have) are needed to run the service.
Downloads are ordinary files
PDF reports and exports you download are not locked. Anyone who gets a copy can read it.
A link is a key
A secure link carries the key to what it shares. Anyone who gets the link — for example from a forwarded email — can open it until it expires or you turn it off.
Keep your own copy
Locking stops anyone reading your data, but you still rely on us to store it. Download a copy of your records from time to time.
For technical readers
The same thing, precisely.
| Record encryption | AES-256-GCM via the browser's built-in Web Crypto API. A random 96-bit IV per record; associated data binds each ciphertext to its record type and ID. |
|---|---|
| Password key derivation | Argon2id (64 MiB memory, 3 passes) with a random per-user salt, run on your device. |
| Separate login & encryption keys | HKDF-SHA256 derives an authentication key (the "sign-in code") and a key-encryption key (the "unlock code") from the Argon2id output. Only the authentication key is sent; the server stores a salted PBKDF2-SHA256 hash of it. |
| Data key | A random 256-bit key per user, wrapped with AES-256-GCM by the password-derived key and, separately, by the recovery key. Held in memory as a non-extractable key while unlocked. |
| Passkey unlock (optional) | Per device. After your device verifies you (Face ID, fingerprint, Windows Hello or PIN), the passkey gives the browser a secret through the WebAuthn PRF extension. HKDF turns it into a key that wraps the same data key with AES-256-GCM, bound to that passkey. The secret never leaves your device; we store only the wrapped key. Passkeys unlock an existing session only — signing in still needs your password. |
| Secure links | A shared report or emergency card is encrypted with AES-256-GCM under a fresh random 256-bit key made for that link only (never the data key), bound to the link id via associated data. The key is placed in the link's #fragment, which browsers don't send to servers, and is never stored. The viewer page fetches the ciphertext and decrypts it in the browser. Links last at most 7 days (24 hours for emergency QR codes), can be revoked, and are deleted at expiry. The QR code is drawn on the device. |
| Recovery key | 256 bits from a cryptographic random generator, with a built-in checksum to catch typos. Replaced after every use. |
| What's encrypted | Every value, date, time and note; which markers you track; custom biomarker definitions; life events; medications, allergies and "taken" check-offs (even which of these kinds each stored item is); your name, date of birth, sex, height, blood type and preferences; family profiles' details and which records belong to each profile. |
| What isn't | Your email address; the number and size of stored records and when they were saved; when you last signed in or opened the app (and whether from the phone's home screen); how many lab-report PDFs were imported each month (the PDF itself is read on the device and never uploaded); for secure links, their size, when they were made and expire, and how many times they were opened; whether each tracked marker is built-in or custom (not which one); how many profiles the account has (not who they are or which records are theirs); your plan and billing status; and standard request logs, such as IP addresses, used for security. Payments are processed by Stripe — card details never reach our servers. |
| Sessions | HttpOnly, SameSite=Strict, host-only secure cookie; invalidated on password change or recovery. |
| Libraries | Cryptography uses the browser's Web Crypto API. The Argon2, PDF and QR code libraries are served from our own site. The only third-party script anywhere is Cloudflare Turnstile (a bot check), on two pages: the first sign-up step, where you enter your email, and the contact form. Both are separate pages that open and close with a full page load: your password is typed, and your keys are created, only on pages where no third-party script has run. |
Reporting a security issue
If you believe you've found a vulnerability, please tell us through our contact form — choose "Security or privacy concern". Please don't include anyone's health information in your report.