How E2E Encryption works

Your browser creates a random encryption key to protect your data. Your passphrase protects that key. A passphrase is a long password for your portfolio.

Our server stores the encrypted data and the protected key. A person with access uses their browser and your passphrase to read the data.

Your email identifies your account. It is not an encryption key. Use at least 12 characters for your passphrase. Choose a long one that you do not use elsewhere.

Technical details: Family Asset Map uses AES-256-GCM for encryption. It uses PBKDF2-SHA256 with 600,000 iterations to create a key from your passphrase.

Keep your passphrase safe

If you lose your passphrase, we cannot recover your data protected by E2E Encryption. An email code lets you sign in. It cannot unlock your encrypted portfolio.

Keep a copy of your passphrase in a safe place. Plan how your family will get it if they cannot contact you.

Family Asset Map is not a cryptocurrency wallet. It does not hold money or offer recovery through a blockchain.

What we can see

We can see account emails, emails of people with access, account and portfolio IDs, access rights, protection modes, and update times. E2E Encryption protects the name and data inside your portfolio. It does not hide who uses the service.

Microsoft Entra handles sign-in. Cloudflare hosts the app and stores data.

Protect your device, browser, and email account. A person or AI agent with access to your unlocked portfolio can read its data.

What Standard mode means

Standard mode is optional. It stores encrypted data, but our server holds the key. Our server can read data in Standard mode. Standard mode does not provide E2E Encryption.

Your portfolio keeps its current protection mode until you change it. A change applies to the current version. It does not change or remove older copies.

Our server can still read older Standard-mode copies after you switch to E2E Encryption.

What you share

You give a person access by email. They can view your whole portfolio, but cannot edit it. For E2E Encryption, they also need your passphrase. Share it separately. Family Asset Map does not send it for you.

If you remove access, the person cannot get more data from the server. This does not erase files, screenshots, or data they already have.

Consider a new passphrase when you change who has access. A new passphrase does not protect older copies that use the old one.

What happens when you export a file

The local edition works offline with a JSON file. JSON is the file format that Family Asset Map uses.

JSON exports are not encrypted. This also applies to exports from E2E Encryption portfolios. Anyone with the file can read it. Store exported files in a safe place.

What encryption cannot do

Encryption cannot protect data if someone controls your device or changes your browser code. It cannot stop a person with access from sharing what they read.

We do not claim an independent security audit or certification.

Use Family Asset Map to show where your assets are. Do not store bank passwords, private keys, or recovery phrases.