Security & Privacy

Trust shouldn’t require faith.

EndPlan is an encrypted vault for the assets, passwords, documents, and final messages your loved ones will need, sealed so tightly even we can’t read it, and released to the right people only when the time comes.

Read the code on GitHub

Zero-Knowledge Architecture

Your keys never leave your device.

Everything you put in EndPlan is encrypted on your phone or laptop before upload. What reaches our servers is ciphertext, mathematically unreadable without keys only you hold. We can’t read your vault. Not for support tickets, not for subpoenas, not for anyone.

POST-QUANTUM Encryption

Encrypted for the next 50 years, not the last 10.

A legacy vault protects data for decades, long enough for quantum computers to break today’s standard encryption. Adversaries already “harvest now, decrypt later.” So EndPlan uses ML-KEM, the NIST-standardized post-quantum algorithm, alongside AES-256. Your grandchildren’s inheritance stays sealed.

NIST ML-KEM (FIPS 203)

AES-256

Hardened key derivation

End-to-end, always

Open Source

Don’t trust us. Verify us.

Our client and encryption code is public on GitHub. Any cryptographer, including the ones who work for our competitors, can read it, audit it, and confirm it does exactly what we say. No other legacy vault dares.

Public code

Client and crypto libraries on GitHub. [Repo link + stars badge]

Github repo

Independent audits

Third-party security audits, reports published in full as they complete.

Responsible disclosure

security.txt, a public disclosure policy, and a bug-bounty programme.

The Release Mechanism

Automatic, but never accidental.

A dead-man’s switch is only as trustworthy as its safeguards. EndPlan’s release process is deliberately slow and reversible until the final step, with human verification by your Key People, if you choose it.

You go quiet

You miss your regular check-in.We escalate: email, push, SMS —over days, not hours.

Your Key People are asked, if you want

By default, the people you chose are independently asked to confirm your status, well, ill, incapacitated, or deceased, and any one of them, or you, can stop the process instantly. Prefer no human step? Confirmation is optional: release can be fully automatic once your waiting period ends.

The waiting period

A final buffer you configure. One tap from you cancels everything.

Release, exactly as instructed

Each recipient receives only what you assigned them. Your Key People get the map; your daughter gets the letter.

The breach that wouldn’t matter.

Every company should plan for its worst day. Ours looks like this: attackers exfiltrate our entire database, and get ciphertext they cannot decrypt. No readable names of your accounts, no documents, no messages. Zero-knowledge isn’t a feature; it’s the reason a breach of us is not a breach of you.

Security questions, answered honestly.

What happens if I lose my password

Today if you lose your password, you will have to contact us at EndPlan to reset it. Since we only store encrypted version of your data, without your password, we cannot acces it. Therefor you will have to re-enter your information. We are working hard to extend our security to allow you to securely recover your password. Let us know if this is an important feature for you. We also allow you an easy download option to backup all of your EndPlan offline. This can be considered as an extra security feature in case of a loss of password. You will then be able to easy reupload all of your information.

What do you do for privacy and security?

We understand that we are storing your sensitive data and protecting it is our highest priority. By design, our business model is “privacy-friendly”. We charge you a subscription so we don’t have any business motivation to sell your information to 3rd parties or for advertising. Here’s our Privacy Policy. EndPlan employs the latest Bank-Level Security practices and industry-leading encryption standards.

Can anyone at EndPlan or a hacker look at my data?

No! Never! As user of EndPlan ourselves, we understand that privacy is a key feature of our product offering and will never change that.

Can I use 2FA?

We are working on bringin this to our users at the earliest date possible. Please drop us a note with your preferred method.

Security to die for.

Read the whitepaper, audit the code, or just start your vault, it’s free for 30 days.

Start free Read the code

Trust shouldn’t require faith.

Your keys never leave your device.

Encrypted for the next 50 years, not the last 10.