Encrypted at the field, not just the disk
Government IDs, phone numbers, account numbers, lab values and free-text medical notes are individually encrypted with AES-256-GCM before they are written. Disk-level encryption protects against a stolen server; this protects against the database itself. Anyone reading the raw table sees ciphertext.
Masked by default, revealed on purpose
Sensitive values render masked everywhere in the app. Seeing one in full is a deliberate action, it requires a role that permits it, and it is written to the audit log. There is no screen that quietly prints your passport number because you happened to open the right page.
Four roles, enforced on every path
Owner, Adult, Limited and Member. Authorization is checked in the API, in server-rendered pages, and in the assistant's retrieval layer — so the bot cannot answer a question using records the person asking is not allowed to see. A teenager on a Limited role can keep their own data without being able to reveal secrets or export the household.
An audit trail you can read
Views, reveals, creates, updates, deletes, exports, logins and assistant queries are all recorded with who, what and when. It is visible inside the app, not a log file you have to ask someone for.
Your files can stay where they already are
Connect your own Google Drive, OneDrive or Synology NAS and Personal360 reads them in place, read-only, streamed on demand. No second copy is made. If you would rather not connect anything, uploads are encrypted and stored by the app instead — that is a choice you make per household, and you can change it later.
The AI does not get your secrets
Sensitive fields are redacted server-side before any text reaches a model. Without an API key configured the assistant degrades to returning your own retrieved records rather than sending anything anywhere.
Accounts & access
- Passwords
- Minimum ten characters with mixed case, a digit and a symbol, hashed with bcrypt at cost 12. The same policy is enforced at sign-up and at reset, with a live checklist on both.
- Sessions
- Signed, HTTP-only, eight-hour session cookies. A successful password reset invalidates every existing session immediately, so a reset genuinely signs other devices out rather than leaving them alive for the remainder of their term.
- Password reset
- Only a hash of the reset token is stored, so a database leak cannot be used to take over accounts. Tokens are single-use, expire in an hour, and requesting one never reveals whether an address has an account. Requests are rate limited per address and per IP.
- Sign-in with Google
- Supported alongside email and password. A Google account is matched to an existing user by verified email address.
- New accounts see nothing
- A newly created account has no household membership, so it can read no records at all until it is granted access or its email matches a pending invitation. That is the default, not a setting.
- Export and deletion
- A household's data can be exported in full, and deleted in full. Deletion removes the records, not just their visibility.
What Personal360 is not
It is not a certified medical device, and it does not diagnose. Lab results are described by their reference range and tracked over time — never interpreted as a clinical finding. It is also not a substitute for the original documents: keep your physical passport, deeds and certificates safe.
Have a security question?
Ask before you sign up, not after. Support answers security questions directly — including the awkward ones.
Read the FAQ