The wall comes first.
The memory lives behind it.
Penny holds intimate household data. The Wi-Fi password. The pediatrician's after-hours line. The decision you made about the gray paint. The pitch is the architecture. Get it right and the product earns the right to be useful. Get it wrong and there is no product worth building.
Eight commitments.
No asterisks.
Encrypted at rest, with a key we don't keep next to the data.
Wi-Fi, codes, member IDs are encrypted with a credentials-specific key. The database on its own can't read them.
Owner re-auth to decrypt anything sensitive.
Every reveal needs a fresh owner session. Scoped to where the value is going. Written to an audit row.
The service role can't decrypt.
The pipeline that captures and surfaces facts has no path to your Wi-Fi password. Decryption requires a human owner. No human, no key.
Every family is an island.
Different database. Different keys. Different network path. No telemetry crosses families. A bug in one cannot reach another.
Not trained on. Not sold. Not aggregated.
Your kids' birthdays, your trip dates, your dishwasher guy. None of it feeds a model, an advertiser, or a broker. Ever.
An audit log we can't rewrite.
Every action and every decrypt is recorded with the message that triggered it. Append-only. We can read the history. We cannot edit it.
Private threads stay private.
If you tell Penny you're planning an anniversary gift, no one else sees it. If a kid forwards her something in their private thread, it never reaches the group. The threads don't bleed.
Hard delete is a real button, not a ticket.
Two owners confirm and your family workspace is gone: primary store, vector store, integration tokens. Encrypted backups roll off on Supabase's PITR window (currently 7 days).
How the wall is built.
Six guarantees. Written into the schema and the CI, not the marketing copy.
- Tenant id on every row. RLS on every table.
- Row-level security keys every read and write to the signed-in family. There is no read path that drops the tenant id and still works.
- pgcrypto and a credentials-specific KMS key.
- Credentials are stored as ciphertext, nothing else. Decryption is a security-definer RPC that demands an owner auth.uid() and logs the surface it was sent to.
- The service role bypasses RLS. It does not bypass the decrypt gate.
- The capture pipeline runs as service role to write facts. It cannot call the decrypt RPC, because the owner-session check fails. No auth.uid(), no key.
- Visibility lives in the message reader.
- Surprise gifts, kid confidences, owner-only briefs each carry their own scope. Cross-thread leaks are CI-tested, not guidelined.
- An append-only log, with no update and no delete.
- Every action and every decrypt writes a row with the message that triggered it. The trigger raises on UPDATE. It raises on DELETE.
- Penny shares infrastructure with nothing.
- Its own database. Its own keys. Its own VPC. A breach in one workspace is an isolation incident, never a cross-product one.
The questions parents ask first.
- Can Penny employees read my family's data?
- No. Sensitive values (Wi-Fi, codes, member IDs) are encrypted with a credentials-specific key. The decrypt path requires an owner auth.uid() and writes an audit row. Service role accounts and operator queries cannot decrypt.
- What if you get acquired? What if you go out of business?
- Your family's database, keys, and audit log are isolated per workspace. We will tell you well in advance of any change of control, and you can hard-delete your workspace at any time. Two owners confirm; primary store, vector store, and Google tokens go immediately. Encrypted backups roll off on Supabase's point-in-time-recovery window (currently 7 days on our plan).
- Is my data used to train models?
- No. Not Penny's models. Not any third party's. Not aggregated. Not anonymized for sale. Your kids' birthdays, your trip dates, your dishwasher repairman do not feed any model or any broker. Ever.
- How do I delete my workspace?
- Two owners confirm a delete from the family admin page. We then purge primary store and vector store immediately, revoke Google integration tokens at the provider, and let encrypted backups roll off on Supabase's point-in-time-recovery window (7 days on our current plan). The audit log of the deletion itself is the only thing that survives, so you can prove it happened.
- What happens if one family member's account is compromised?
- Sensitive surfaces (the vault, owner-only briefs) require a fresh owner session, not a long-lived bearer. A compromised member account cannot decrypt vault values, cannot escalate to owner, and cannot read another member's private thread.
- When does Penny override the privacy promise?
- Only on a real-danger signal in a kid's private thread (self-harm, abuse, somebody in physical danger). When that fires, Penny alerts the owners and tells the kid she is doing it. Triggers are conservative, hard-coded, and every override writes an audit row. She does not pass casual confidences to parents, and she does not break scope to settle an argument.