Engineering
How we build.
Specifics, not superlatives. Each fact below comes from Gentle Handover, our first product, and says how we know it is true.
Keeping data safe
Encryption and keys
Encrypted by our own code
What people keep in their boxes, the text of their letters and plans, and their recordings are stored encrypted by our application with AES-256-GCM. AES is the encryption standard published by the US National Institute of Standards and Technology. Names and titles, such as a box's name or a letter's title, stay readable so the service can show them.
How we know:
Our encryption design records, part by part, which data is encrypted and how.
We hold the keys
Our servers can open what people store, so it can reach their families when the time comes. That means Gentle Handover is not zero-knowledge, and we would rather you hear it from us. How Gentle Handover keeps that power in check.
How we know:
The zero-knowledge mode is switched off, and our readiness check fails if anyone switches it on.
Where data lives
Location and analytics
Analytics only with consent
In Gentle Handover no analytics runs until a visitor agrees, and none at all when the browser sends Global Privacy Control, a setting that asks websites not to sell or share your data. With consent, we keep our own page log for 90 days.
How we know:
An automated test fails if any analytics loads before consent.
No cookies on this website
This website runs one small script of its own, only to remember light or dark. No cookies, no analytics, no forms, no database. It loads nothing from other websites, and its typefaces are served from this site.
How we know:
Our tests open every page of this site and fail on any other script, any cookie, or any request to another address.
Before anything ships
Tests and release gates
Thousands of tests
Our code is checked by thousands of automated tests, a code style check and a scan for leaked secrets.
How we know:
The checks run on GitHub, where our code lives, before a release.
Rules tied to their tests
The rules Gentle Handover must never break are written down, each with the tests that prove it.
How we know:
A check fails when a rule names no test, or a test that does not exist.
A sealed audit trail
Every sensitive action, by an account owner, a member of staff or the system, is written to an audit trail sealed in a keyed hash chain.
How we know:
A scheduled check verifies the chain every night, and any break raises an alert.
Staff sign in with two steps
Nobody on our team reaches the admin tools without two-step sign-in. Staff who decide on a death also need a passkey, a sign-in key kept on their device that cannot be phished.
How we know:
Enforced in code on every admin page.
For everyone
Accessibility and languages
Checked every night
We aim for WCAG 2.1 level AA, the international accessibility guidelines from the W3C. Every night an automated check tests key pages of Gentle Handover in light and dark, on a desktop and a phone.
How we know:
The check uses axe-core, an open source accessibility testing engine. Known issues are listed and tracked, so we do not claim full conformance.
Ready for more languages
Gentle Handover starts in English. All of its words live in language files, so a new language is a translation, not a rewrite.
How we know:
Translation checks in our test suite cover emails, the family portal and the admin screens.
This website, too
Every page of humanful.org is checked against WCAG 2.1 levels A and AA, in light and dark, on a desktop and a phone, in every language it is published in.
How we know:
The checks run with axe-core each time the site is tested.