You trust us with what matters most

One thing first, because it's at the heart of everything below: Bruidswarenhuis is built so that we ourselves can do as little as possible. Not because we don't trust ourselves, but because what no one can open cannot be stolen, extorted, or accidentally leaked. This principle runs through every choice on this page.

On the way to us: encrypted connection

Everything between your browser and Bruidswarenhuis travels over an encrypted connection (TLS). On public wifi, no one can eavesdrop or alter your message in transit. Your browser also refuses to ever open Bruidswarenhuis unencrypted — even if you accidentally type the wrong address yourself. This setting applies a year ahead and renews itself with each visit, so the first visit on a new device is the only theoretical weak moment and never again after that.

The security certificate that makes that connection possible renews automatically. If that ever fails silently, our own monitoring will sound the alarm three weeks beforehand — well before any visitor notices anything.

At the door: hackers, bots and DDoS attacks

All traffic to Bruidswarenhuis first passes through Cloudflare, one of the world's largest protection networks. It filters out attack traffic before it ever reaches our own server. A DDoS attack — where someone brings down a site by flooding it with requests — is caught there on a scale that no individual server can handle.

A common mistake is that the own server remains simply directly reachable afterwards, allowing an attacker to simply bypass that protection. With us, that can't happen: our server categorically refuses any connection that doesn't come through Cloudflare. Admin access is further limited to one fixed address and works only with a cryptographic key — passwords are simply disabled, so there's nothing to guess.

• Crawlers and scanners that scour the internet for vulnerable software are recognized and ignored.
• Login attempts are limited per address: after a handful of failed attempts, the door locks temporarily.
• Every form action is protected against misuse from other websites.

Your password: unreadable, even to us

Your password is stored nowhere. What we store is an irreversible calculation of it, made with a method that is deliberately slow and memory-intensive (scrypt) and gets its own random addition for each user. Should someone ever get their hands on our database, there would be no passwords in it, and the usual approach — trying billions of passwords per second — would yield nothing useful. When checking your password, we also compare it in a way that reveals no information through timing differences.

Two-factor authentication — we highly recommend it

By far the most accounts that get taken over anywhere on the internet are lost because the password was leaked elsewhere and reused. Two-factor authentication makes that virtually impossible: in addition to your password, you then need a code that only you receive at that moment.

With Bruidswarenhuis that works simply via your email or an SMS — no separate app you have to install and figure out. You choose what feels right to you. You get backup codes you can save in case you lose your phone.

It's not required. You can skip it every time you log in and just continue. We'll keep suggesting it, though, because we'd rather you spend two extra seconds than ever lose your memories. Administrators of Bruidswarenhuis have no choice: two-factor authentication is mandatory for them.

Your messages: who can actually access them?

Your messages, your diary, your vault and all your files are encrypted on our servers in Frankfurt, within the European Union. They don't leave the EU.

One exception that we state honestly: if you use the AI Clone, then your interview recordings go to specialized services for speech recognition and voice building. That processing can take place outside the EU, with the legal safeguards that apply. That applies only to that one function, and only if you turn it on yourself — all your messages and your vault remain in Europe in any case. We are in talks to get that part within the EU as well. Which processors we engage is stated in our privacy statement.

More important than wHERE they stand, is who can read them: nobody at Bruidswarenhuis. There is no screen, no button and no administrator function with which an employee can open the content of your messages. That is not a promise about good behavior, but a choice in the architecture: that possibility simply doesn't exist. What an employee can see is whether an account exists, how many messages are in it and whether delivery was successful — the administration around it, never the content.

Also: after activation of an account, everything is locked. From that point on, even the rightful owner can no longer change or withdraw anything. What you have prepared remains exactly as you left it.

The digital vault: encrypted in your browser

For your most sensitive matters — passwords, documents, a personal video — there is the digital vault. It works fundamentally differently than the rest, and the difference is worth understanding.

The encryption happens here in your own browser, with a passphrase that you choose and that is never sent to us. What our server receives and stores is a block of ciphertext that we cannot do anything with. There is no master key, no backdoor and no recovery procedure. If the passphrase is lost, the vault is permanently unreadable — even for us. That sounds harsh, and it is; at the same time it is precisely what makes the vault so secure. A key that we would have could also be stolen.

Upon delivery to your recipient, three independent things are needed: a code by SMS, a code by email, and your physical passphrase that you have shared outside Bruidswarenhuis. Whoever has two, cannot get in. Read how that works in practice on the page about the digital vault.

The cloned voice cannot be used against you

A fake voice has become a real means of fraud. That is why the voice of an AI Clone at Bruidswarenhuis can only speak its own answers and never a text that someone feeds it — that boundary is built into both the AI and the technology underneath. The detailed explanation is on the page about the AI Clone.

If it does go wrong: backups and recovery

Every hour we make a complete, encrypted backup: the complete database, and in the same round also the new files such as videos and recordings. Every hour a separate copy, so not just the latest version. They are stored in a different location than the server itself, so one problem never affects both.

What that means in practice: if something goes seriously wrong, at worst one hour of work could be lost — no day. For something that people spend years building, we think that makes the difference worthwhile.

A backup that you have never restored is an assumption and not a certainty. That is why we periodically perform a real recovery test: the copy is actually restored and checked. That way we know it works on the day it needs to work.

Every night we check ourselves

Security is not a state but maintenance. New vulnerabilities appear daily in software that everyone uses, certificates expire, settings shift. That is why we run an automatic check every night that looks at exactly that:

• new vulnerabilities in the building blocks that Bruidswarenhuis runs on;
• certificates that are approaching their end date;
• security settings that have been removed;
• the email security that prevents someone from sending mail on behalf of Bruidswarenhuis;
• unusual patterns, such as a sudden wave of failed login attempts or an administrator logging in from an unknown address.

That check only reports itself if something ís wrong. A report that tells you every morning that everything is fine, no one reads after two weeks — and that's precisely when you miss the night things go wrong.

Everything stays yours — even if we disappear

You can download everything you have with us at any time with one click: messages, videos, recordings, contacts. In standard file formats that you can open without Bruidswarenhuis. And should Bruidswarenhuis ever cease to exist, there is an established procedure for that with at least six months' notice. It is described at the frequently asked questions.

Found a vulnerability?

If you discover a security issue, please let us know via office@psily.net instead of making it public. We respond quickly, keep you informed of the solution and greatly appreciate it. Feel free to investigate, but stay away from other users' data and don't take the service offline.

Want to know which data we process about you and why? That's in our privacy statement.