Trust
Afterward is built so the only people who can read your binder are the ones you choose. Not us. Not the company that built it. Not anyone holding a subpoena addressed to us.
Below: how that works in plain language, what we do hold, and the trade-offs we made on purpose.
The pledge
Your binder is sealed on your device before it ever reaches us.
We do not, structurally, hold the means to open it.
You can take everything with you on any plan, at any time, without our help.
The ledger
A short, honest accounting. The left column is what sits on our servers. The right column is what never does.
We hold
Your sealed binder, as a closed envelope.
We can move it, replicate it, deliver it. We cannot read it.
Your account email and login state.
When you last edited.
No record of what you edited.
Your inactivity-check settings.
How long, who to notify, whether the courtesy interval is on.
We do not hold
The contents of your binder.
Not the names, not the accounts, not the documents, none of it.
Your sealed envelopes.
The three things only your trusted person should ever see.
The keys to open any of it.
Your device holds them. The recovery passphrase you wrote down holds them. We don’t.
Anyone’s access until you grant it.
Two ways your binder opens
Two doors to the same room. We never made the second one optional, because the first one fits in your pocket and pockets get lost.
When you sign in, your device proves it’s yours the same way it unlocks your banking app: your face, your fingerprint, the passcode it already trusts. From that, your binder opens.
The proof never leaves the device. We see only that the door was opened, not the key that opened it.
Used most days. Quiet, one-tap, never types a password.
On the day you sign up, Afterward generates twenty-four ordinary words and asks you to write them somewhere private: a safe, a wallet pocket, an envelope tucked inside a book.
Those words are the second way in. They unlock the same binder if your phone is ever lost, broken, or replaced. We do not know what they are.
Used rarely, perhaps never. There the day you need it.
Both doors open the same envelope. Not two copies of the binder, two ways to reach for it.
If something goes wrong
If you lose your phone
You sign in on a new device with your recovery words. Afterward verifies the words against the second door, opens the binder, and quietly enrolls the new device as another way in.
The old device, even if it’s found later, no longer holds an active key. You can revoke it from the settings page in a single tap.
If you forget the passphrase too
We can’t open it for you. Not because we won’t: because the architecture genuinely doesn’t allow it. The same property that keeps a court out is the property that keeps us out.
This is a trade-off we made deliberately. Every product that promises a way back in for the forgetful holds the means to read your data on a quiet day. We don’t want to.
The honest list
Every product in this category quietly hopes you don’t ask. The list below is the one we’d want you to read before you trust us with anything.
A breach of our servers.
They would find sealed binders. Without your device or your recovery words, the contents stay closed.
Someone working at Afterward going looking.
No employee, founder, or engineer can read what you wrote. The system is built so that capability does not exist.
A subpoena addressed to us.
We can hand over what we hold: sealed envelopes and account metadata. We cannot hand over what we never received.
A government compelling us to open a binder.
There is no door for us to open. We document this publicly so a court has the architecture in writing.
Your device being read while it is unlocked.
If someone is using your phone while you’re signed in, we can’t tell the difference between you and them. Your phone passcode is your last line.
Sharing your recovery words with the wrong person.
The words are the binder. Anyone who has them can open it. We tell you this plainly the day you make them.
A determined attacker watching your screen.
No technology fixes shoulder-surfing. The binder’s contents are still yours to handle with care.
The courtesy interval
If you stop opening Afterward for sixty days, we send a quiet note asking if anything has changed. A check-in, not an alarm.
If we still don’t hear from you after that, the people you named can ask to read what you left them, and you have seven days to say no. The whole interval is yours to tune longer or shorter.
Most of the time, no one ever needs this. It runs in the background like a thoughtful friend, so the binder can do what it’s there for.
If you decide to leave
Your binder belongs to you, not to us. At any time, you can download a complete archive: every section, every recipient assignment, every sealed envelope, in a format your family can read without our help.
The archive is sealed with your recovery passphrase, so the file in your hands isn’t legible to anyone else who gets hold of it. You hold the words; we don’t.
The day you decide we aren’t for you is the day you walk out with what you came in with. We don’t keep a copy.
The audit ledger
We did not put logos here. The category does that, and they all blur. Below is the actual schedule.
SOC 2 Type II
In progress
Audit window opened February 2026 with a regional firm specializing in consumer privacy products. Report expected mid-July.
Target · 2026-07-15
Independent security review
Selecting
A specialist firm will review the sealed-envelope architecture and the recovery-passphrase path before v1 launch. Selection is in progress; the public summary will be linked from this page once the engagement begins.
Engagement · pre-launch
Penetration testing
Recurring
External pen test before every named release, plus an annual full-scope test. Findings go to the engineering team and to a public changelog after remediation.
Cadence · per release + annual
Security whitepaper
In draft
A public, plain-language description of the sealed-envelope architecture, recovery model, and threat boundaries. This is the document a court would read in lieu of asking us to open a binder we structurally cannot open.
Publishing · with v1
For the technically curious
Open this if you want the architecture summary, not the metaphor. It is the same story, written for a security-minded reader.
The full security whitepaper, with the cryptographic primitives named in the precise vocabulary, publishes alongside v1. If you have questions before then, write to security@afterward.care.
Free to start. No card. Export everything anytime, including the day you decide we’re not for you.
