Security
We're a small, independent product, not an enterprise vendor — this page describes what is actually implemented today, not what sounds impressive. If something below changes, we'll update it here rather than let the page fall out of date.
Passwords
Your password is hashed with bcrypt before it's stored — we never store the password itself, and nobody with access to the database can read it back. Signup requires at least 8 characters.
Breach check
When you set or change a password, we check it against the Have I Been Pwned breach corpus using k-anonymity: only the first 5 characters of its SHA-1 hash are sent, so the password itself never leaves our server. The check has a short timeout and fails open — if the breach-check service is down, it won't block you from signing up.
Sessions
A session token is 32 random bytes generated on the server. Only a one-way hash of it is stored in our database — the token itself is not. Sessions last 30 days and quietly renew while you're active; the cookie is httpOnly, marked secure in production, and set to SameSite=Lax.
Two-factor authentication
Optional TOTP two-factor (the same standard, RFC 6238, used by most authenticator apps) generates a 6-digit code every 30 seconds. The shared secret is encrypted at rest, and each code can only ever be accepted once — reusing a code, even the correct one, is rejected. If you turn it on, you get 8 single-use backup codes for if you lose your device.
Requests are checked, not just cookies
Actions that change your account or data are checked against where the request actually came from, and rejected if it doesn't match. Chat is also rate-limited per account, so a compromised or scripted session can't hammer the service.
What's encrypted, and what isn't
Traffic to and from the site is encrypted (HTTPS). Your two-factor secret is encrypted at rest. But this is not end-to-end encryption: your conversations and memories are stored in a form the operator could, technically, read. We're telling you that plainly rather than implying otherwise — if you need a guarantee that literally no one can ever see your data, this product doesn't offer that today.
Hosting and backups
The service runs on our own servers in Germany, not on a shared cloud platform. The database is only reachable from the server itself, not the open internet. We take nightly encrypted backups and copy them off the server. Errors are reported to a self-hosted error-tracking instance we run — no third-party analytics vendor sees your data.
Protections in your browser
Every response carries a Content-Security-Policy and a Permissions-Policy header. The Permissions-Policy switches off camera, microphone, geolocation and payment access for the site. A frame-ancestors rule stops the site being loaded inside someone else's page, which is the usual way clickjacking attacks work.
Deleting your account
Deleting your account requires re-entering your password and typing DELETE to confirm. It happens in a single step and is immediate and permanent — there's no 30-day grace period holding a copy behind the scenes.
What we don't have yet
We're honest about the gaps: no independent third-party security audit, no formal certification like SOC 2 or ISO 27001, and no dedicated security team — this is a one-person operation. We'd rather say that clearly than let a badge imply something that isn't true.
Reporting a vulnerability
Found a problem? Please tell us before telling anyone else, so it can be fixed first: email hello@myaifamilyfriend.com with what you found and how to reproduce it. There's no paid bug bounty — this is a one-person operation, so please be patient if a reply takes a few days. We do read every report.
Questions? Email hello@myaifamilyfriend.com.