Your family’s most sensitive information, protected.
Estate planning involves the most personal data you’ll ever store digitally. Here’s how we protect it.
Encryption
AES-256-GCM for high-risk data
Selected secrets and document content receive authenticated application-layer encryption before storage.
Authenticated encryption
Selected high-risk fields use AES-256-GCM so confidentiality and integrity are checked when encrypted data is read.
High-risk fields protected individually
Selected secrets are encrypted separately with a fresh IV and authentication tag before they are stored.
Built-in key rotation
Ciphertext can carry a key identifier so planned rotations can retain older decryption keys while new data uses the active key.
Tamper detection
New AES-GCM ciphertext includes an authentication tag so altered encrypted values fail integrity checks.
What we encrypt
What we never store:Seed phrases, full card numbers, or anything we don’t need. If we don’t need it, we don’t keep it.
Access Control
Who can see what, and when
Strict role-based access ensures the right people see only the right information, at the right time.
Secure authentication
Industry-standard authentication with multi-factor verification, passwordless login, and automatic session management built in.
Data isolation
Server-side authorisation and estate-ownership checks restrict each request to the records that account is allowed to access.
Role-based access
Customer access is separated across owner, executor, and beneficiary responsibilities. Server-side checks enforce the records available to each request.
Session management
Admin pages warn after the configured inactivity period and lock the interface while secure sign-out is attempted. Identity-provider session lifetimes are configured separately.
Rate limiting
Sensitive actions use per-user or per-IP rate limits alongside authentication and authorisation to reduce automated abuse.
Executor visibility controls
Executors use an authenticated portal. Sensitive post-death access depends on role checks, owner sharing choices, and the estate verification state.
Compliance
Transparent data protection
Clear controls, documented service providers, and practical support for your UK data-protection rights.
Transparent data processing
We document the service providers that process data and explain international processing in our privacy and cookie notices.
UK GDPR rights
You can exercise access, correction, deletion, restriction, objection, and portability rights through our privacy contact.
Soft-delete architecture
Many user-managed records are soft-deleted first and later handled under the applicable retention process.
Security review programme
We review code, dependencies, and security controls, track findings, and validate remediations. Reviews reduce risk but cannot eliminate it.
No sale of personal data
We do not sell personal data. Vetted service providers process limited data only to operate and improve Beqst, as described in our notices.
Recovery controls
Backup, retention, and recovery responsibilities depend on each configured infrastructure provider; restore evidence is reviewed separately from this product page.
Protected Data
What we protect
Controls are applied according to the sensitivity and use of each data category.
Bank details
Selected account numbers, sort codes, and banking credentials receive field-level encryption.
Property records
Property records are access controlled; uploaded supporting documents are encrypted before object storage.
Digital credentials
Passwords, PINs, access codes, and digital account details — encrypted individually.
Legal documents
Uploaded document content is encrypted before object storage and access is checked before retrieval.
Family relationships
Beneficiary and executor assignments, relationship details, and contact information.
Final wishes
Final-wish records are access controlled, and sensitive personal-message fields receive application-layer encryption.
Our Principles
Security by design, not afterthought
Risk-based encryption
Vault secrets, selected financial credentials, will-draft data, and document content receive application-layer encryption before storage.
Least privilege access
Executor and beneficiary access is constrained by assigned roles, estate state, and the owner's sharing choices.
Transparency
Sensitive actions generate audit events to support accountability and incident investigation. Event coverage is reviewed and expanded over time.
Frequently asked questions
Ready to secure your estate?
Join the Beqst beta and protect your family's most sensitive information. No credit card required.