Security at OpenWill
Last updated: 25 September 2026
The short version
- Your information is encrypted in transit and at rest.
- Only you can see your plans until you choose to share them, or until a release is confirmed by two of your executors.
- We never store your full card details.
- Found a security issue? Email security@openwill.app.
1. Encryption
- In transit: all connections to OpenWill use HTTPS with modern TLS.
- At rest: your data and documents are encrypted at rest by our cloud infrastructure provider.
2. Access controls
- Each account's information is separated from every other account, using database-level row access policies on user-facing tables.
- Executors and beneficiaries can only see what you've chosen to share with them. Beneficiaries only ever see their own allocations.
- Only a small number of OpenWill staff can access production systems, only when needed (for example to resolve a support issue you've raised), and access is restricted to legitimate operational needs and logged where supported by our infrastructure.
3. Account security
- Passwords are handled by our authentication provider using strong one-way hashing. We can never see your password.
- We'll email you about important account and estate activity where the Service supports that notification.
4. Two-executor release
Live Will documents are never released on one person's word. Two of your executors must each independently confirm. They must provide an official death certificate or equivalent evidence, and OpenWill staff review the evidence before approving release. Every confirmation is recorded.
5. Payments
Payments are processed by Paddle, which is certified to PCI DSS Level 1. We never see or store your full card number.
6. Our infrastructure and providers
OpenWill runs on secure, managed cloud infrastructure. Data may be stored and processed in the EEA and the United States under appropriate transfer safeguards. We only use providers that meet strong security standards, and we have data processing agreements with each of them. See our Privacy Policy for the full list.
7. Backups and resilience
Our cloud infrastructure maintains regular managed backups, so your plans can be recovered if something goes wrong. Backups are encrypted.
8. If something goes wrong
If we ever have a security incident that's likely to put your information at risk, we'll tell you without undue delay, explain what happened and what we're doing about it, and notify the Information Commissioner's Office where required.
9. What you can do
- Use a strong, unique password, and keep access to your email account secure.
- Choose executors you trust, and keep their contact details up to date.
- Never share your login details, including with the people named in your will.
- Be wary of emails asking for your password. OpenWill will never ask you for it.
10. Responsible disclosure
If you believe you've found a security vulnerability, please email security@openwill.app with details and steps to reproduce it.
We ask that you:
- don't access, change or delete data that isn't yours;
- don't disrupt the Service or use social engineering or physical attacks; and
- give us reasonable time to fix the issue before telling anyone else.
If you act in good faith and follow these guidelines, we won't take legal action against you. We'll acknowledge your report within 3 working days and keep you updated.