Closed beta

Security at Dommy

Some things are more personal than money. Dommy protects them with layered encryption, isolated storage, short-lived access, and tested recovery.

Who can see what

  • Private by default

    There is no feed, no directory, and nothing for a crawler to index. What you put in Dommy is visible only to the people you brought in. Nothing is published, and strangers have no surface to browse.

  • Each Dynamic is sealed off

    Each Dynamic has isolated storage, separate from every other. Every request is checked against your membership and consent for that specific Dynamic. Access to one never grants access to another.

  • Access ends when you say so

    Permissions are explicitly granted and can be revoked. New activity stops immediately after revocation or departure, and existing authorization expires within two minutes.

  • You control the AI connection

    Dommy AI uses an AI provider account that you connect separately for each Dynamic. Conversations are sent to that provider under your agreement with them, and the provider key is stored encrypted. Dommy AI cannot expose content, pause or end a Dynamic, or use emergency release. Lock actions are limited to permissions both people granted and are proposal-only by default.

How your data is stored

  • Encrypted in transit and at rest

    Every connection to Dommy is encrypted in transit, and every store the service writes to is encrypted at rest.

  • Multiple layers of encryption

    Dommy adds application-level AES-256-GCM encryption before protected data reaches storage. The keys needed to decrypt it are secured separately in an external key vault, so a database copy alone is not enough to reveal it.

  • Codes and tokens are stored as hashes

    Sign-in codes and login links are stored as one-way hashes. Session tokens are not stored. A database copy cannot be used to recover them.

When things go wrong

  • Independent encrypted backups

    Encrypted snapshots are sent on a schedule to an independent storage provider. They remain encrypted in transit and at rest, and require the separate key vault for recovery.

  • Weekly recovery testing

    An automated drill tests the restore path every week, including emergency release without relying on the main platform.

  • Logs don’t hold your content

    Operational logs contain request metadata and error states, not private account data or tokens.

Your account

  • Passwordless sign-in

    Dommy uses passkeys and one-time email codes instead of passwords. Codes expire after 10 minutes and stop working after five incorrect attempts. The sign-in flow does not reveal whether an email address has an account.

  • Revoke every session

    “Sign out everywhere” revokes every session and disconnects live connections immediately. Issued tokens expire within 10 minutes, and sensitive operations check revocation immediately.

Leaving

  • Account deletion requires fresh verification

    Deleting an account requires a new email code; an existing session is not enough. The account profile, history, sessions, passkeys, and push subscriptions are deleted rather than marked inactive.

  • Deletion limits and inactive accounts

    Deletion cannot remove copies another participant already received. Required financial records are retained in minimized form and separated from your profile. Accounts inactive for 24 months are deleted after a warning at 23 months.