Security

Households stay separate

Each house is its own tenant. A person who belongs to one household cannot open another household's items, people, vehicles, vault entries, files, meal plans, or audit log. If they are not a member, the app answers "not found" rather than confirming the record exists. Inside a household, the role still matters: a guest can read the books, staff can do day-to-day work, and only the Super Admin can open Super Vault, estate documents, and the full audit log.

Super Vault

Bank accounts, investment accounts, and similar secrets sit in Super Vault, not in the everyday wifi list. Only the household Super Admin can register a passkey and unlock it. Unlock is a real Face ID, Touch ID, Windows Hello, or security-key check, and it lasts about five minutes. Each household has its own random key. Entries are encrypted at rest with AES-256-GCM.

This is not end-to-end encryption. After a valid unlock, the application server can unwrap the household key and read the entry. Someone who steals only the database cannot read those rows unless they also have the wrap secret. Someone who compromises the running app and that secret can. WebAuthn proves the Super Admin is present. It does not lock the key inside the phone's hardware. There is no operator switch that decrypts Super Vault for staff or for the company.

An admin can ask for recovery. Filing that request does not reveal secrets. Completing it still requires the Super Admin to unlock with a passkey. Everyday wifi and streaming codes are not encrypted this way. They are stored with the household and shown only to roles allowed to see them.

The activity log

The household audit log records who did what, and when, for the changes that matter: inventory edits, vault access, people, files, and settings. The application refuses to update or delete those rows. Owners have no button for that.

That is not a sealed evidence locker. It is not cryptographic write-once storage, it is not a hash chain, and it is not proof against someone who has the database itself. Most ordinary browsing is not logged. A screenshot is not logged. Do not treat the log as a court record.

The browser

Each response asks the browser not to frame this site, not to sniff a file into a different type, and to allow the camera and microphone only here. Sign-in cookies are marked so a script on another site cannot read them. This is ordinary web hygiene. It is not a certification, and it does not encrypt a household on the phone.

What we do not claim

• Organized Casa is not end-to-end encrypted.
• Organized Casa does not have a SOC 2 report, and this page is not a certification.
• The audit log is not tamper-proof against a database administrator.
• Passkeys do not make a stolen server unable to decrypt Super Vault.

Where the data lives

Where household data is stored, who processes it, and how export and deletion work today are on the data handling page.

Report a problem

Email security@organized.casa if you believe you have found a vulnerability. Please describe what you saw and how to reproduce it. Give us a chance to fix it before you publish details. The machine-readable contact file is security.txt, valid through October 6, 2027.