Security and privacy
Your family’s records are yours.
You are handing us birth certificates, passports, and the names of everyone you descend from. The question worth asking is not which cipher we use. It is what we will do with all of it, and who else gets it. This page answers that, including the parts that are not flattering.
The commitments
What we will and will not do.
Each one links to where it is actually enforced — a clause in the Terms, a published list, a mechanism in the product. A commitment that links to nothing is marketing.
We do not sell, license, rent, or share your family records.
This is a term of the contract you have with us, not a line on a marketing page. A marketing claim can be rewritten. A clause has to be honoured.
Read the clause →We are not a data broker, and we are not owned by one.
We make money selling software to families. We have never made money moving family data anywhere, and the Privacy Policy now binds any future owner to the same terms before a transfer can happen.
See the successor clause →We never become the intermediary between you and the issuing office.
Your certified records are mailed by the issuing office to the address on your own request. We prepare the request and check it; the office sends the certificate to you. We are not a stop along the way, so there is no point at which we hold your paper.
How record requests work →We do not hand your documents to third-party AI companies.
One AI provider reads your documents: Anthropic, whose Claude model extracts names, dates, and places so we can check eligibility and prefill your forms. Under Anthropic's Commercial Terms it may not train on your content, and inputs are deleted within 30 days. No other model provider receives anything.
See exactly what it receives →Your documents stay scoped to you.
Relatives on a shared family case see that a record has arrived and what it unblocks. They do not get the file. Scoping is enforced by the database and by server-side ownership checks, not by what the interface chooses to render.
How scoping is enforced →We publish every company that touches your data.
12 subprocessors, each named, with what it receives and why. Consumer products almost never do this. Naming them is a stronger signal than any badge, because it is checkable.
Read the list →
How it actually works
We are not zero‑knowledge, and here is why.
Every vault product in this category leads with zero-knowledge encryption: the provider holds no key and literally cannot read your files. It is a genuinely strong guarantee, and we cannot make it.
Our server has to read your documents. It reads a birthplace and a date to work out whether your grandmother’s line qualifies. It reads a certificate to prefill the form you are about to send a foreign government. It reads a record to tell you it is the wrong one before an office rejects it. A server that cannot decrypt your documents cannot do any of that. This is not a gap we intend to close later — it is structural, and any zero-knowledge claim from us would be false.
So the honest question is what protects you instead, given that we can read the file:
What protects you instead
In transit
TLS 1.3 with HSTS preloaded, so a browser will not attempt an unencrypted connection to us even once.
At rest
Documents and database rows are encrypted at rest by our infrastructure providers on the systems that store them. We do not run our own key custody, and we do not claim to.
Document access
Files are never public. Each view is a single-purpose link that expires five minutes after it is issued, granted only after the server has confirmed you own the document.
Database scoping
Row-level security policies scope records to the account that owns them, enforced by Postgres itself. A query that forgets a filter still returns nothing it should not.
Sign-in
Email magic links with a bot challenge on the entry point. There is no password to reuse, leak, or have stolen from another site.
Where data lives
The United States. Database and file storage in AWS us-east-2 (Ohio); application hosting served from Vercel's iad1 region.
A guarantee you can verify beats a stronger one you cannot.
Who can see your documents
Three answers, including the awkward one.
You
Full access
- Every document you upload, whenever you want it.
- Every record ordered for your own application.
- Download or replace anything at any time.
Your family
Status, not files
- Relatives on a shared case see that a document has arrived and what it unblocks.
- They do not receive the file itself.
- One exception, stated plainly: the person who owns the family case can see the record entries attached to that case, because they are the one assembling the application.
Heritage Passport staff
Yes, and not yet logged
- Staff can reach uploaded documents through an administrative key that bypasses the database’s own access rules. This is how support helps when an upload fails or a record is rejected.
- That access is not currently written to an audit log you could inspect. The log table exists and is append-only; nothing writes to it yet. We are wiring it, and this sentence changes when we do.
- Access is limited to people with an operations or founder role.
What we are not
The other way to order a vital record.
VitalChek, the ordering channel most U.S. vital-records offices point you to, is part of LexisNexis Risk Solutions. Its own privacy disclosure describes your information moving among the issuing agency, LexisNexis and RELX affiliates, and vendors handling identity verification, payment, support, and shipping.
That is a description of a corporate structure, published on their own site, and it is the entire commentary we will offer. We have nothing to say about how they conduct themselves.
We are a different shape. We sell software to families. Your records are not an input to another business we own, and there is no affiliate on the other side of us that benefits from seeing them.
If we shut down.
Start with the part that matters most: your certificates are already yours. The issuing office mailed them to your address. They are in your filing cabinet. Nothing about whether this company continues to exist changes that — which is a direct consequence of never taking custody of your paper in the first place.
What we hold is your case data and the scans you uploaded. On that, we commit to:
- 90 days notice before any planned shutdown.
- Your data back, in full, throughout that period and for 90 days after — no fee, no artificial download limits, no degraded export.
- No transfer to anyone who will not accept these terms. If we are acquired, a successor must agree in writing to be bound by our Privacy Policy before your information moves. If they will not sign, your information is not included.
Export and deletion are handled by us on request rather than by a button in the product. Your rights are the same either way — the Privacy Policy sets them out.
Reporting something
Found a problem? Tell us.
If you believe you have found a vulnerability, a data-handling mistake, or anything on this page that is not true, write to support@heritagepassport.co. Tell us what you found and how to reproduce it.
We will acknowledge that we received it, tell you what we found, and tell you what we changed. We do not run a paid bounty programme and we are not going to pretend otherwise. We will not pursue anyone who reports a genuine issue in good faith and does not access or alter another person’s data while finding it.
We hold no SOC 2 report, no ISO 27001 certificate, and no completed penetration test. When we hold one, it will be named here with the date it was issued.