Security, and how Final Saying actually works

You are trusting this service with words you may not want anyone to read for years, and with a decision about when they should be read. You should know exactly how that works, including the parts that are less reassuring. This page describes the system as it is built today, not as we would like it to be.

Final Saying is built and run by one person, Vilva Athiban P B, in Berlin. Questions about anything here: contact@finalsaying.com.

Short version

• The text and subject of every message are encrypted (AES-256-GCM) before they are written to the database.
• The key is held on our server, not by you. This is not end-to-end or zero-knowledge encryption. Someone with access to both our server and our database, which today means the operator, could technically decrypt messages.
• Photo attachments are stored separately in object storage and are not covered by the message encryption above.
• Messages are delivered only after a check-in email and three reminder emails over 17 days go unanswered, and only if the final reminder was actually sent.
• If Final Saying stops operating, undelivered messages will not be delivered. Keep your own copy of anything important.

Who holds the keys

When you save a message, the server encrypts the message body and the email subject with AES-256-GCM. For each value it generates a fresh random salt and initialisation vector and derives the encryption key from a single server secret using PBKDF2-SHA256 with 100,000 iterations. The encrypted value is what sits in the database. The server secret is stored in the server's configuration, separately from the database.

That design protects against one specific risk: someone obtaining a copy of the database (for example a leaked backup) without the server secret. It does not protect against the operator. The server has to decrypt your messages to show them to you in your dashboard and to deliver them, so the operator can technically read them. We do not look at message content, but you are relying on that policy, not on mathematics. If you need a guarantee that no one but your recipient can ever read something, do not store it here in plain words. Store where to find it instead, as described in our guide on sharing passwords with family.

If the server secret were lost, encrypted messages could not be recovered by anyone, including us.

What is stored, and what is not encrypted

• Encrypted: message text and email subject lines.
• Not encrypted: your name and email address, your phone number if you add one, recipient names, recipient email addresses and phone numbers, the sender name you choose, your check-in dates and delivery status.
• Photo attachments: stored in object storage under long random file names. They are not listed or searchable, and they are not encrypted with your message key.
• In transit: the site and API are served over HTTPS only, with HSTS. The application connects to its database over TLS.
• Hosting: the application server and a managed PostgreSQL database run on DigitalOcean. Sign-in sessions are stored in that database and identified by an HTTP-only cookie.
• After delivery: delivered messages are kept until you, or your estate, ask us to delete them. Recipients open messages through a private link; the first time a recipient opens it, we record the time.

You can edit or delete any message from your dashboard before it is delivered. Deleting a message also deletes its photos. There is currently no button to delete your whole account; email contact@finalsaying.com and we will do it.

Signing in

You sign in with Google. We receive your name, email address and a Google account identifier, never your Google password. Every sign-in also counts as a check-in.

How the check-in countdown works

You choose how often we check on you: every 6 months or yearly on the free plan, and also every 15 days, monthly or every 3 months on Premium. When your check-in date arrives, the sequence below starts. Clicking the link in any of these emails, or signing in, stops it and resets your schedule. One link stays valid for the whole sequence.

Safeguards built into this sequence:

• No email, no countdown. If the day-0 email fails to send, the countdown does not start; we try again the next day.
• No final reminder, no delivery. If the day-15 reminder was never sent (for example, because our email provider was down), you are not marked as deceased, even after day 17. We would rather deliver late than deliver to someone who was never properly warned.
• Every check-in and reminder email asks you to add noreply@finalsaying.com to your contacts. The biggest real risk to a check-in system is your own spam filter. Please do it, and check your spam folder occasionally.

One honest limitation: the 17 days are counted from the first check-in email. If our server were down for several days in the middle of a sequence, the reminders it missed would be sent when it comes back, so they could arrive closer together than the table above suggests.

Where our emails and WhatsApp messages come from

• noreply@finalsaying.com sends every automated email: check-in requests, all reminders, and the final messages your recipients receive by email.
• contact@finalsaying.com is our support address.
• WhatsApp reminders (Premium) and WhatsApp notifications to recipients come from our WhatsApp Business sender through Twilio.

Add both email addresses to your contacts now, and ask the people you have written to to do the same, so a message that arrives years from now is not buried in a spam folder. We never ask for a password or payment details by email or WhatsApp.

How delivery works

• Email messages are sent through our email provider (Resend) from noreply@finalsaying.com, with your photos attached. The email also tells the recipient how we got their address and how to ask us to delete it.
• WhatsApp messages (Premium) are sent through Twilio using a WhatsApp-approved template. The WhatsApp message itself does not contain your text: it names you and links to a private page on finalsaying.com where the recipient reads your message.
• Only active messages are delivered. On the free plan that is your first email message.
• Failed deliveries are retried up to three times with increasing gaps (6 hours, then 24 hours), and the operator is alerted if a delivery fails permanently.
• Delivery cannot be undone. If you were marked as deceased by mistake, the operator can reactivate your account, which stops anything still pending, but messages already sent cannot be recalled.

Keeping the system running

The check-in and delivery jobs run once a day on our server. A watchdog checks every hour that each job has succeeded within the last day, re-runs any job that was missed, and emails the operator if one is stuck. This is a single-server system run by one person, not a large company with an on-call team.

What happens if Final Saying shuts down

This is the hardest question for any service like this, and the honest answer today is:

• If the service stops, messages that have not been delivered will not be delivered.
• Our Terms commit us to make reasonable efforts to email you in advance if we decide to close, so you can copy your messages and make other arrangements. There is no one-click export yet; you can open and copy each message from your dashboard.
• There is currently no escrow arrangement, no successor organisation, and no independent party holding a copy of the key. If the operator died or could no longer run the service, it would keep running only for as long as its hosting continued to be paid and nothing broke.
• For these reasons: do not make Final Saying the only copy of anything that matters. Keep your will and important documents with a lawyer or a trusted person, and tell someone you trust that your Final Saying messages exist.

If you want a complete picture of what to put where, our free digital legacy checklist covers devices, accounts, passwords and personal messages, and our guide to digital wills versus legal wills explains what each can and cannot do.

What we cannot guarantee

We do our best to make every check-in and delivery happen on time, but some things are outside our control, and our Terms (Section 16) say plainly that we are not responsible for them:

• Emails filtered into spam or junk, for you or for your recipients, or rejected by their email provider.
• WhatsApp or Twilio blocking, delaying or restricting our messages, or a number that is not on WhatsApp.
• Wrong or outdated email addresses and phone numbers.
• Server, hosting or provider outages, bugs, and attacks on our systems.
• Final Saying shutting down, including if the operator can no longer run it.

None of this limits our liability where the law does not allow it to be limited, such as for intent or gross negligence.

Reporting a security problem

If you think you have found a vulnerability, please email contact@finalsaying.com with details. We will reply, fix what we can, and tell you what we changed.