Lineage/Trust
Trust & security
Your family’s. Never ours to browse.
You are being asked to put the most complete record of a family’s wealth in one place. That is a large ask, and the only honest answer is specifics. Below is what we actually operate, what each control answers to, and where it sits.
Architecture in one paragraph
Isolation at the storage layer, not in a query.
The common design is one large database with a household identifier on every row, where correctness depends on every query remembering to filter correctly. One missing clause and one family sees another’s.
Each household gets its own isolated database instance — a dedicated, separate database — with personal information encrypted under a key unique to that household, derived rather than stored. Cross-household access is not forbidden by a filter. It has no path to take.
A dedicated instance per household rather than a shared table partitioned by a column.
Platform AES-256 at rest, beneath a household-specific layer whose key is derived, never stored next to the data.
Delete a household and its key is destroyed. Any leftover ciphertext becomes permanently unreadable — by anyone, us included.
The controls we operate
Every control, and what each one answers to.
These are ours — designed, run and evidenced by us. Each is mapped to the standards and statutes that actually ask for it, in every regime we operate in, so a due-diligence questionnaire can be answered from this table rather than from a call.
The same control usually answers several regimes at once. That is the point of designing against a framework backbone instead of building per jurisdiction.
| Control | What we operate | Answers |
|---|---|---|
| Tenant isolation | A dedicated database instance per household, not a shared table partitioned by a query filter. Cross-household access has no path to take. | NIST 800-53 SCISO/IEC 27001 A.8SOC 2 CC6DPDP Act s.8IT Act SPDI |
| Encryption at rest | Platform AES-256 beneath a household-specific layer. The household key is derived, never stored alongside the data it opens. | NIST 800-53 SCISO/IEC 27001 A.8SOC 2 CC6GLBA SafeguardsDPDP Act s.8 |
| Encryption in transit | Modern TLS everywhere, with legacy protocol versions and cipher suites disabled rather than merely deprioritised. | NIST 800-53 SCISO/IEC 27001 A.8SOC 2 CC6IT Act SPDI |
| Identity & authentication | Multi-factor sign-in with a one-time code rather than a password to forget. No shared credentials, and no standing staff login into a household. | NIST 800-53 IAISO/IEC 27001 A.5SOC 2 CC6IRS Pub. 4557GLBA Safeguards |
| Access control & scoping | Every grant to a family member or a professional names its scope and carries an end date. Nothing is permanent by default, and revocation is immediate. | NIST 800-53 ACISO/IEC 27001 A.5SOC 2 CC6IRC §7216DPDP Act s.8 |
| Consent capture | Professional access is recorded against a consent record with a version and an expiry, so authority and action are evidenced together. | IRC §7216DPDP Act s.6CCPA / CPRA |
| Audit logging | Append-only logs per household covering every view and every change — by staff, by the family, and by anyone they granted access to. The household can read its own log. | NIST 800-53 AUISO/IEC 27001 A.8SOC 2 CC7CERT-In Directions 2022 |
| Log retention | Request logs retained for 180 days within India, alongside synchronised time across the estate so a sequence of events can actually be reconstructed. | CERT-In Directions 2022NIST 800-53 AUISO/IEC 27001 A.8 |
| Incident response | A documented process with defined severities. Six-hour reporting to CERT-In for the incident classes it covers, and a 48-hour notification commitment to affected firms with scope, vector and remediation timeline. | CERT-In Directions 2022DPDP Act s.8(6)NIST 800-53 IRSOC 2 CC7 |
| Data minimisation | We hold what the family picture needs and decline the rest. No advertising identifiers, no behavioural profiling, no data collected because it might be useful later. | DPDP Act s.6CCPA / CPRAISO/IEC 27001 A.5 |
| User rights | Self-service export, access, correction and deletion, without asking us. Deletion destroys the household key rather than only the rows. | DPDP Act s.11–13CCPA / CPRAUS state privacy laws |
| Grievance redressal | A published route to a named office, acknowledged within 24 hours and resolved within 15 days. Verified data-subject requests answered within 90 days. | IT Rules 2021 r.3(2)DPDP Act s.13Consumer Protection (E-Commerce) Rules 2020 |
| Vendor & subprocessor control | A deliberately short list. No third-party identity, analytics, aggregation or AI provider is in the path of client data. | DPDP Act s.8(2)SOC 2 CC9ISO/IEC 27001 A.5 |
| Vulnerability management | Dependency and platform patching tracked against severity, with remediation timelines that shorten as severity rises. | NIST 800-53 RAISO/IEC 27001 A.8SOC 2 CC7GLBA Safeguards |
| Information security programme | Documented, owned, and mapped to the framework backbone rather than assembled per questionnaire. | NIST 800-53 Rev 5GLBA SafeguardsISO/IEC 27001 A.5IT Act SPDI Rules |
The regimes behind the mapping
Two jurisdictions, one set of controls.
Obligations differ by jurisdiction, but what a regulator wants to see is remarkably consistent: who could reach the data, under what authority, held where, for how long, and what happened when something went wrong. India is live today; the United States applies at launch.
India
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 Information Technology Act, 2000 and the SPDI Rules IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 CERT-In Cyber Security Directions, 2022 Consumer Protection (E-Commerce) Rules, 2020
United States At launch
GLBA Safeguards Rule — information security programme obligations IRC §7216 — use and disclosure of tax return information, consent-gated IRS Publication 4557 — safeguarding taxpayer data, multi-factor authentication CCPA and CPRA, and the state privacy statutes that follow them
Frameworks
NIST SP 800-53 Rev 5 — the backbone our controls are designed against ISO/IEC 27001 Annex A — organisational, people and technological controls SOC 2 Trust Services Criteria — security, availability, confidentiality, privacy
Data residency
Geo-aware, component by component.
Residency is configured to Cloudflare best practice, using location hints so storage and compute are placed in the region appropriate to the data rather than in one fixed place. It is geo-aware rather than pinned to a single continent.
Database placement is expressed as a Cloudflare geo hint, because that is the mechanism the platform provides for regional placement — so it is named as exactly that below, rather than described as a guarantee.
| Component | How it is placed | Status |
|---|---|---|
| Application database | Cloudflare geo hints — region selected by location hint, geo-aware | Geo hints |
| Per-household database instances | Cloudflare geo hints, applied per household at creation | Geo hints |
| Document storage | Regional buckets created with a location hint | In place |
| Workers compute | Regional placement configured to Cloudflare best practice | In place |
| Short-lived session storage | Configured regionally; tokens are short-lived by design | In place |
| Outbound email | Cloudflare Email Sending | In place |
Subprocessors
Two, and they are the same company.
Most platforms in this category run a dozen or more: an identity vendor, an analytics vendor, an account aggregator, a model provider. Each is another boundary your data crosses and another disclosure somebody has to make.
We use no third-party identity, analytics, aggregator or AI providers.
Cloudflare
All data stores, compute, transactional email and the global edge.
Cloudflare Workers AI
All AI processing — document extraction fallback and transaction classification. No model provider outside this boundary receives client data.
Nobody else
No third-party identity, analytics, aggregation or AI vendor. An architectural property, not a contractual promise from a subprocessor.
Every vendor you add is a boundary your client’s data crosses.
The shortest list
wins.
What the platform brings
Cloudflare’s certifications, named as Cloudflare’s.
Trust pages routinely list a cloud provider’s certifications in a way that reads as the company’s own. We are not going to do that.
Everything in this section belongs to Cloudflare, the platform we build on. It is real, it matters, and it covers the infrastructure your data sits on. It is not an audit of Lineage.
| Standard | Held by | What it covers |
|---|---|---|
| SOC 2 Type II | Cloudflare | Covers the platform your data is deposited on — data centres, storage and network. |
| ISO/IEC 27001 | Cloudflare | The international standard for the policies, processes and controls protecting customer data. |
| PCI DSS Level 1 | Cloudflare | Card-data handling at the highest level. We never touch card data; this signals platform control maturity. |
| FedRAMP Moderate | Cloudflare | A US federal authorisation covering a US operational boundary. |
| HIPAA BAA | Cloudflare | Available where applicable. |
Continuity
And if Lineage stops existing?
Every other commitment on this page answers what happens if you leave. This one answers what happens if we do — which is the fair question to ask of anything selling continuity, and the one such companies usually avoid.
We are an early company. Naming the risk plainly is worth more than a reassurance nobody can verify.
| Concern | Where we stand |
|---|---|
| Getting your data out | Export is available at all times, without asking us, free on every tier and after you stop paying. It returns the documents you supplied and the structured picture built from them, in formats that outlive us. |
| Not depending on us being here | Because export is always open, the safe practice is to hold your own copy and refresh it periodically. We would rather tell you to do that than pretend it is unnecessary. |
| Wind-down notice | If the service were ever to close, we would give notice before shutdown, keep export working throughout that period, and say so directly rather than by changing a policy page quietly. |
| Documents held in custody | Where we hold a will or comparable document in custody, its handling on wind-down is set out in the terms for that service, and the document is returned to you or your nominated professional — not stranded. |
| Your encryption keys | Household keys are derived rather than stored. Deletion destroys the key, which is what makes deletion real — and it means no successor entity inherits a readable copy of your household. |
| Escrow | Not in place A formal third-party data escrow arrangement does not exist today. We will say so here until it does, rather than imply one. |
The last row is deliberately not green. A trust page that only lists finished work is marketing, not disclosure.
Statutory contacts
Who to write to, and what we owe you.
These obligations are jurisdiction-specific, so this section follows the region selected at the top of the page. India requires a named Grievance Officer under the IT Rules, 2021 and the DPDP Act, 2023. The United States imposes no equivalent, so none is invented for it.
For data-rights requests the fastest route is the in-product data rights flow, which tracks the request through to resolution.
India: Live. The designations below are statutory and currently in force.
| Role | Required by | Contact |
|---|---|---|
| Grievance Officer | IT (Intermediary Guidelines) Rules, 2021 r.3(2) — complaints about the service | Rajesh S contact@lineage.money |
| Data Protection Officer | DPDP Act, 2023 s.10 — personal-data requests; compelled only once notified a Significant Data Fiduciary, designated here in advance | Rajesh S contact@lineage.money |
| One contact | The same person holds both designations, so a complaint about the service and a request about personal data reach the same desk. You do not have to work out which statute applies before writing. |
|---|---|
| Acknowledgement | Within 24 hours of a complaint reaching the Grievance Officer. |
| Resolution | Within 15 days, or a written interim status and a revised timeline where the matter is genuinely complex. |
| Data subject requests | Within 90 days of a verified request, as required by the DPDP Act and Rules. |
| Security incidents | Six-hour reporting to CERT-In for the classes it covers; 48-hour notification to affected firms. |
| Grievance records | Retained for three years from resolution, for audit. |
Write to contact@lineage.money for privacy questions, security disclosures and subprocessor enquiries. Security questionnaires are answered by someone who can read the architecture.
United States: Launching soon. The entity details below will be published before launch.
US law imposes no equivalent of India’s designated Grievance Officer, so none is named here. Privacy, security and consumer-rights enquiries reach the same address, and the US registered entity and address will be published before launch.
| Privacy enquiries | Answered from contact@lineage.money — the same desk that handles security review. |
|---|---|
| Consumer rights requests | Access, deletion, correction and opt-out handled in-product, as CCPA and CPRA require. |
| Tax information | Professional access to tax return information gated by an IRC §7216 consent record with an expiry. |
| Security incidents | 48-hour notification commitment to affected firms, with scope, vector and remediation timeline. |
Write to contact@lineage.money for privacy questions, security disclosures and subprocessor enquiries. Security questionnaires are answered by someone who can read the architecture.
Straight answers
The uncomfortable questions.
Do you sell or share our data?
No. Not to lenders, insurers, advertisers or data brokers. There is no version of this business where a family’s balance sheet is the product being sold. If that ever changed it would be a different company, and you would be told before it happened.
Is our data used to train AI models?
No. Inference runs on Cloudflare Workers AI inside our own boundary, and no third-party model provider receives client documents or client data. Machine reading operates on your household’s data for your household’s benefit, and every extracted figure is reconciled against its source document before it is presented as fact.
Who can see a household’s data?
Nobody, by default, other than the household itself. Access reaches anyone else only through a grant the household issues, with a named scope and an end date. Every opening is written to an append-only log the household can read. Staff hold no browsing key; support access is per-incident, approved by you, time-boxed, and logged like any other opening.
Which certifications does Lineage itself hold?
We publish the controls we operate and the standards those controls answer to, above. The SOC 2, ISO 27001, PCI DSS and FedRAMP items on this page are Cloudflare’s, covering the infrastructure beneath us, and are labelled as such throughout. We will name a certification of our own when one exists, and not before.
What happens if there is a breach?
Six-hour reporting to CERT-In for the incident classes it covers, and a 48-hour notification commitment to affected firms with the scope, the vector and a remediation timeline — not a holding statement.
Can we get everything out, or delete it for good?
Yes, at any time, without asking anyone. Export returns the documents supplied and the structured picture built from them. Deletion destroys the household key rather than only the rows, which renders any remaining ciphertext permanently unreadable.
Ask the hard question.
Due-diligence questionnaires, security reviews and subprocessor enquiries all go to the same address, and reach someone who can answer them.