Data handling
This page says where a household's information lives, who can see it, and which companies process it. It describes the software as it is written.
Who can see a household
Only people invited into that household, and only the parts their role allows. A person from another household gets "not found." The security page describes the roles, the passkey unlock, and the activity log.
The Super Admin can open Super Vault and estate documents after a passkey check on their own device. That check stays between this app and the device. Staff and guests cannot open those records. Everyday wifi and streaming codes follow the role rules.
Anyone who can read the production database can read the records stored in the clear. Super Vault secrets and estate PDF bytes are encrypted in the application, so the database alone does not show them. After a valid Super Admin unlock, the running app can decrypt them. There is no switch that decrypts Super Vault for staff or for the company without that unlock.
Where it is stored
The site is hosted on Vercel. Pages, form fields, and uploads pass through that host because the application runs there. Region: not stated. This repository does not set one.
Household records are stored in Postgres. Production is set up on Neon. Region: not stated. The app stores data in whatever database URL it is given. Local development can use a SQLite file on the machine running the app, and that copy does not go to Neon.
Photos and files stay with the household data. On Vercel they are stored in the same database. On a machine using disk storage they sit in an uploads folder on that machine. They are not sent to a separate file host.
Sign-in is part of this app. The account email and a scrypt password hash live in the same database. The sign-in cookie is HttpOnly, and on the hosted site it is only sent over HTTPS. There is no separate login company. Optional two-step sign-in uses an authenticator app. A Super Admin can require that step for admins of a household. The switch starts off. The authenticator secret and backup codes are encrypted in that same database. There is no text-message code, and the app does not send those codes to an SMS provider.
Who else processes it
These are the services the code calls. A service that is off until a key is added receives nothing until that key is set.
Vercel
Hosting, when the site is deployed there
Receives the household's requests — pages, form fields, and files as they are uploaded — because the app runs on Vercel. The code does not call a separate Vercel data API.
Neon
Database, when the URL is Neon Postgres
Receives the household records the app stores, including encrypted Super Vault data. Production uses Neon. A local SQLite file does not.
OpenAI
Off until a key is set
Used for Alfred and for inventory photo drafts. Off until OPENAI_API_KEY is set. Without that key, Alfred answers on this server from the household books, photo drafts are sample text, and speech stays in the browser. AI_BUTLER_DEMO=1 keeps Alfred's chat on this server even if a key is present. AI_INVENTORY_DEMO=1 keeps photo drafts as samples. Speech still calls OpenAI when the key is set.
A chat call sends the household name, the member's role, the question and recent messages, and a short slice of records that member can already see: room and item names, people names and companies, tasks, this week's events, project and vehicle names, non-sensitive manual titles, a few department notes, restock names and Amazon links, and everyday vault labels. Passwords and codes are not in that slice. Super Vault contents and sensitive manual pages are not sent. A question about Super Vault or a sensitive manual page is answered here and is not sent.
A photo draft sends the photo and up to 80 folder names. Speech, when the key is set, sends the recording to be transcribed, or the reply text to be read aloud.
An Admin or Super Admin can turn AI features off for one household. When that switch is off, Alfred, photo drafts, and speech are refused before any information from that household is sent to OpenAI.
Resend
Off until a key is set
Sends invite, password-reset, and email-verification messages. Off until EMAIL_FROM and RESEND_API_KEY are both set. Until then the app does not call Resend. An invite is shown as a link to copy, and password reset by email is unavailable.
When it is on, Resend receives the recipient's email address and the message: the household name, role, and accept link; or a reset link; or a verification link.
Postmark
Off until a key is set
The same emails, and only when EMAIL_FROM is set, Resend's key is not set, and POSTMARK_SERVER_TOKEN is set. Otherwise the app does not call Postmark. It receives the same address and message Resend would.
Sentry
Off until a key is set
Error monitoring. Off until SENTRY_DSN or NEXT_PUBLIC_SENTRY_DSN is set. Until then the SDK does not start, and nothing is sent.
When it is on, Sentry receives a scrubbed error report: a stack trace and the route. Request bodies, cookies, auth headers, and query strings are removed. Household rows and Super Vault plaintext are not attached. A household id can still appear in a path. Session Replay is off. Source maps are uploaded only when a Sentry auth token, organization, and project are all set.
Analytics
No product analytics
No analytics product is installed. The Next.js framework can send an anonymous note about the software itself. That note does not include household records. Amazon product links the household saves open in the browser. The app does not call an Amazon API.
What is encrypted
Super Vault entries and estate PDF files are encrypted in the application before they are stored. Each household has its own random key. The encryption is AES-256-GCM. That key is wrapped with a secret the server holds.
Estate document titles, notes, and file names are stored in the clear. The PDF bytes are the encrypted part.
Inventory, people, tasks, the calendar, meals, the house manual (including sensitive pages such as gate codes), everyday wifi and streaming passwords, and photos and other files are stored without that encryption. Roles decide who in the household can see them. The database connection may use TLS. That protects the connection. It does not encrypt those rows.
What we do not claim
- Organized Casa does not have a SOC 2 report. This page is not a certification.
- Organized Casa is not end-to-end encrypted.
- A passkey does not make a stolen server unable to decrypt Super Vault.
- The activity log is not tamper-proof against someone who has the database.
- The data region is not stated.
- Backups are not running. The job waits until its secrets are set. See below.
- There is no analytics product and no privacy certification.
Backups
A nightly job in this repository can save an encrypted copy of the production database outside Neon. It does not run until a person adds the backup secrets. Until then the job says backup is not configured, takes no dump, and uploads nothing. A restore point exists only after that person has set the secrets and the job has succeeded.
Photos and files on the hosted site are stored in that database, so the copy includes them when the job runs. The job encrypts the copy before it uploads it. The machine that runs the job does not hold the key that decrypts it.
Neon can keep its own history. That history is not this backup. This page does not treat it as a restore that has been practiced.
Before a schema change, production notes still tell an operator to take a Neon backup or branch by hand. That step is separate from this job.
Export
The Super Admin can download the household from Household Settings → Export household. The file is a zip of JSON and CSV, plus photos and attachments. Sensitive house manual pages are included. Super Vault entries and estate PDFs are left out. Copy those from Super Vault after unlocking with a passkey, and download each estate PDF there. Password hashes, sign-in sessions, invite tokens, and encryption keys are left out. Authenticator secrets and backup codes are left out.
Deletion
A Super Admin can remove a person from the household. That removes their membership and their Super Vault unlock for this house. The household's records stay. Their account stays if they still belong to another house.
Someone with permission can delete some records one at a time: a calendar event, a project, a meal, a manual page, a photo, a file, a restock line, an everyday vault entry, or a Super Vault entry after unlock. People can be archived. Inventory items and estate PDFs have no delete action in the app.
A Super Admin can request deletion of the whole household from Household Settings. Before that request is confirmed, the page asks them to download the Export household zip. They then type the household name. That schedules deletion 30 days out. It does not delete the household yet. Every member of that household sees a banner with the date. A Super Admin can cancel during those 30 days, and the household stays.
After that date, a person runs the final purge by hand. The app does not run it on a timer, and there is no button that deletes the household immediately. The purge removes that household's records, including photos and files stored in the database and Super Vault. Other households are left as they are. An account that belonged only to the deleted household is kept, with no household, so that person can be invited somewhere else or start a new house.
Encrypted backups, once the backup job is running, keep 14 daily copies and 8 weekly copies. Those copies roll off within about 8 weeks. Until the backup secrets are set, that job uploads nothing. A restored copy can bring a purged household back. The purge then has to be run again for that household.
Email security@organized.casa to ask for help with a deletion.
Questions
Email security@organized.casa.