How we safeguard your messages

Every message is encrypted with the Advanced Encryption Standard in Galois Counter Mode with a 256 bit key (AES 256 GCM). Each message has its own randomly generated key. That message key is itself encrypted with a master key that is held in the application environment and is never written to the database. The database stores the encrypted content, the encrypted message key, the initialisation vectors for each, and the version number of the master key that was used.

Written text is encrypted on the inAmber server at the moment it is saved.

Audio and video are encrypted in your browser before they leave your device. The server generates the message key and the initialisation vector, stores only the encrypted form of the key, and returns the key to your browser with a signed upload address that expires after one hour. Your browser encrypts the file through the Web Crypto interface and uploads the encrypted file directly to storage. The server does not receive the unencrypted recording.

The master key is versioned. A new version can be introduced and old messages remain readable under the version recorded against them, without re encrypting any content.

A copy of the database without the master key contains no readable message content.

inAmber holds the master key. It is therefore technically able to decrypt message content. This is not zero knowledge encryption, and it is not end to end encryption in the strict sense. The design is deliberate: a message must be openable by the person it was written for even if the writer is no longer here and no device of theirs remains.

Decryption of written text happens on the server only in the routes that open a message: for the recipient after their identity has been checked, and for the author reading their own draft or sealed message. Decryption of audio and video happens in the reader’s browser, after the server has checked they are entitled to the file and released the key with a download address that expires after fifteen minutes.

No administrative screen in the application displays message content. A subject access request from the author is the one other circumstance in which content is decrypted, and it is returned to the author.

Without decrypting, the server can read the information needed to run the service: your name and email address, the title and occasion of a message, the delivery date or event, and the names, email addresses and relationships of the people you have named.

The database, authentication records and encrypted audio and video are held by Supabase in London, United Kingdom.

The application runs on Vercel, pinned to the London region. The master key is held in that environment, separately from the database.

Email is sent through Resend from Ireland.

Payments are processed by Stripe. Card details are not held by inAmber.

Domain name services for inamber.ai are provided by Cloudflare.

The recipient. When a message is delivered, the recipient receives an email containing their name and a link. The email contains no content, no occasion and no preview. The link carries a token that cannot be guessed. To open the message the recipient signs in to a free account using the email address the message was sent to. A link forwarded to another address does not open the message. A recipient may open a message again as many times as they wish.

A recipient under eighteen cannot open a message until the adult they named has confirmed by email that they consent.

The author. You can read your own drafts and sealed messages while your account is open.

A guardian. A guardian is someone you name to confirm that an event has occurred. They receive a link with a token and answer yes or no, with an optional note. A guardian is never shown message content.

Every opening by a recipient, and every response by a guardian or a consenting adult, is recorded with the time and a hashed form of the network address.

A scheduled job runs every five minutes. It finds sealed messages whose delivery moment has arrived and hands each one to a single delivery path. Each message is claimed in a delivery queue that permits exactly one entry per message, so a message cannot be sent twice. If an email cannot be sent, the message is not marked delivered and the job tries again on a later run using the recipient’s current address.

A message set to a date is sent at nine in the morning in the recipient’s time zone on that date, unless you chose a time. A message set to an event is not sent by the clock; it waits for a guardian to confirm the event. A message set to “whenever they choose” is handed to the recipient at the moment it is sealed, and they open it in their own time.

Delivery does not depend on the author’s subscription. A purchase buys a block of years in which messages can be created and sealed. When the block ends, no new messages can be created, and every message already sealed still delivers.

At least ten pence in every pound is set aside for delivering sealed messages, and nothing else. Its purpose is to fund the storage and delivery of sealed messages independently of the company’s operating income. At five hundred customers or £50,000 accumulated, whichever comes first, the endowment moves into a trust with independent trustees and a published deed.

At the date of this page the endowment is a line in the accounts. No trust, escrow arrangement or successor custodian exists yet. When one is appointed, we will name them here.

• No voice cloning, no deepfakes, no synthetic people. inAmber delivers the real recording of the real person and never generates a likeness of anyone.
• Your messages are never used to train a model. Your conversations with Amber are used to teach inAmber’s own model only if you say yes to helping Amber learn, and you can stop at any time in Settings.
• We set advert cookies only if you say yes, and only on our public pages. They never run in your vault, on your messages, or where a message is delivered, and nothing you write is ever shared with an advertising network.
• Personal data is never sold, rented or shared for marketing.

Write to hello@inamber.ai with “Security” in the subject line. Describe what you found and how to reproduce it. Do not include message content or another person’s data in the report.

Where a breach creates a risk to people, the Information Commissioner’s Office is notified within seventy two hours and the people affected are told without undue delay where the risk to them is high.

Related documents: privacy policy, your data rights.