Part XI
Your data and privacy
How documents and sensitive fields are encrypted, how personal identifiers are handled, who can see what, the audit trail, and closing your account.
How your documents are protected
An estate file is an unusually concentrated collection of sensitive information: the decedent's Social Security number, full account numbers at every institution they banked with, their complete financial position, and the personal details of everyone inheriting. Protection is layered accordingly.
| Layer | What it covers |
|---|---|
| Files at rest | Uploaded documents are encrypted in storage using managed encryption keys. Storage rejects any attempt to write a file unencrypted. |
| Identifiers read from documents | Personal identifiers that Heirwise extracts from an uploaded document are encrypted with a key generated for that document, and the plaintext copy is cleared from the record it was read into. |
| In transit | Everything moves over encrypted connections. |
| Access on request | Viewing or downloading a document is authorized per request against your access to that specific estate, and again against the document's own storage location. |
That second row is specifically about identifiers Heirwise reads out of a document during processing. Do not assume it covers everything you type into Heirwise by hand. If you are entering a Social Security number or an account number directly into a form, treat it as ordinary stored data.
The weakest link is usually your own account. Use a strong password you don't use anywhere else, and if your sign-in method offers two-factor authentication, turn it on there. No amount of encryption at our end helps if someone can simply log in as you.
Personal identifiers
When Heirwise processes an uploaded document it identifies personal identifiers — Social Security numbers, account numbers, dates of birth — and handles them separately from ordinary text, encrypting them and clearing the plaintext copy from the extracted record.
Do not assume identifiers are removed or masked elsewhere in the product. In particular, asking Elin about a document means that document's contents are sent to the model that produces the answer. Ask about documents rather than typing identifiers into the chat, and don't paste a Social Security number or account number into a message.
If you need certainty about how a specific identifier is stored or transmitted — because a beneficiary asks, or because your own professional obligations require it — ask us rather than inferring it from this guide.
Who can see what
Access is per estate and per role. You see the estate you created, and nothing else — data belonging to other users is not merely hidden from the interface, it's filtered out of the request before results are assembled.
| Who | Can see |
|---|---|
| You, as executor | Everything on the estate you created. |
| A beneficiary | The portal for their estate only, scoped to them — the phase, a plain solvency status, their own distribution once unlocked, and their own details. |
| Another Heirwise user | Nothing about your estate. |
Beneficiary access is the only kind you can grant. There is currently no way to give a second person executor-level access to an estate — if you are serving alongside a co-executor, only one of you can hold the estate in Heirwise.
Revoking access takes effect immediately: a revoked participant is denied, not merely hidden from. They remain visible in your roster afterward so the record of who had access and when is preserved.
Beneficiary visibility is governed by the estate's state, not by the invitation. Inviting someone early does not expose figures that aren't ready — the three distribution conditions still apply.
The audit trail
Consequential changes to an estate are recorded with who made them and when. Locking or unlocking the inventory, locking the distribution plan, and similar state changes all leave a trail.
This is for your benefit more than anyone's. An executor may be asked to account for their administration long after closing, and a contemporaneous record of what changed and when is far better evidence than recollection.
It's also why Heirwise prefers marking things than deleting them. A liability marked paid records that the estate owed it and settled it. Deleting it removes it from the totals and leaves nothing to point at later.
Add a note when you do something unusual — a debt you disputed, an asset that sold well below its recorded value. Your reasoning is obvious to you now and won't be in two years.
Taking your data with you, and closing your account
Your data is not held hostage. There are two routes out, and one of them you should use regardless of whether you're leaving.
| Route | What you get |
|---|---|
| Any single document | From the vault — the exact original file you uploaded, or any document Heirwise generated. |
| The complete records archive | One ZIP with a financials workbook, every uploaded document, and every generated PDF. The final task in Phase 3. |
Download the records archive before you close anything. It is the artifact you keep, and reconstructing an estate after the fact is far harder than saving a file now.
Closing your Heirwise account
You can close your account from the end of the process, once the estate is closed. It's a deliberate action — you type a confirmation phrase, because it isn't something to do by accident.
Two things to know. You need to close the estate first; Heirwise will tell you if you try to close the account while an estate is still open. And closure sets a date on which your data is purged, which Heirwise shows you at the time.
That purge date is real. Once it passes, the documents and records are gone and cannot be recovered. Take the archive first.
If you need a complete account-level export in some other form, or have a question about retention that this doesn't answer, get in touch rather than guessing.