Our Nests security
What this does and does not protect against
This page is written so you can decide, before you put a real password intoOur Nests’s vault, exactly what that buys you and what it does not. It is the same table our own engineering design documents use internally — not a marketing rewrite of it.
The honest table
Rows marked with a triangle and a dashed border are things nothing we build can protect you against — that is what “NO” means below, and we are not softening it.
| If this happens… | Is what I stored in my vault safe? | Why |
|---|---|---|
| Someone steals Our Nests's database | Yes | We only ever store a scrambled version of your logins. The key to unscramble them is made from your passphrase, which we never receive and never store. |
| Someone steals a backup of Our Nests's database | Yes | Same reason. A backup contains the same scrambled data and no key. |
| Someone who works on Our Nests gets curious about your family | Yes, for the vault | Nobody at Our Nests can read your vault. Not a support person, not an administrator, not the person who wrote the code. There is no “admin override” button, because there is no mechanism for one to exist. But: your calendar, your children’s schedule, and the addresses you have saved are not scrambled, so they are protected by access rules rather than by maths. A determined insider with the right credentials could reach those. |
| A court orders Our Nests to hand over your vault | Yes | We would have to comply with a valid order, and what we would hand over is the scrambled data. We cannot produce your passwords because we cannot unscramble them. But: we can be compelled to hand over your calendar, custody schedule, addresses and therapy details — and we would have to. |
| Our Nests's hosting provider is breached | Yes, for the vault | They hold the same scrambled data we do. Your calendar and addresses would be exposed. |
| Someone guesses or steals your Our Nests password and signs in as you | Yes, for the vault | Signing in does not open the vault. The vault needs your passphrase, which is separate and which we do not hold. They would see your calendar and addresses. |
| You lose your phone while you are signed in | Yes, for the vault | The vault locks itself after five minutes, and whenever you switch away from the app. Whoever has the phone would need your passphrase. They could see your calendar until the session expires — which is why you should use “sign out everywhere” from another device. |
| Someone gets into your email | Yes, for the vault | Email cannot recover your vault. It cannot recover your account either without your second factor. |
| You forget your passphrase | You can still get in — with your Recovery Kit | That printed sheet is a second, independent key. |
| You forget your passphrase AND lose your Recovery Kit | No — and neither can we | Your vault is gone, permanently. We are not being unhelpful; there is genuinely no copy. This is the cost of nobody else being able to read it. |
| Someone attacks Our Nests’s website code and changes it (a "malicious deployment") | NO — a limitation we cannot protect against | Our Nests runs in your browser as code we send you each time you open it. If someone replaced that code with a version that quietly copies your passphrase as you type it, the encryption would not help — the code doing the encrypting would be the code stealing it. This is the biggest limitation of building Our Nests as a website instead of an app-store app. |
| An attacker manages to inject their own code into a Our Nests page (a "cross-site scripting" bug) | NO — a limitation we cannot protect against | Same reason. We work hard to make this impossible (see below), but "hard" is not "impossible". |
| A piece of open-source code Our Nests uses is tampered with by its author or a hacker | NO — a limitation we cannot protect against | Same reason — it would become part of the code running in your browser. |
| Your phone or computer has spyware or a keylogger on it | NO — a limitation we cannot protect against | Anything typed on a compromised device can be captured before Our Nests ever sees it. No website or app can fix this. |
| Someone is standing next to you demanding your passphrase | NO — a limitation we cannot protect against | No technology can protect you from this. If you are in that situation, 1800RESPECT (1800 737 732) is a free, confidential counselling service you can call any time of day or night — and you can destroy your vault from Settings if you need to. |
| Your calendar, your children’s schedule, or an address you saved | Not encrypted the way the vault is | These are shared with your co-parent, sorted and displayed, so they cannot be scrambled in the same way. They are protected by strict access rules enforced in the database, but a breach of our systems would expose them. Telling you if that happened is not a courtesy — it is a legal obligation under Australia’s Notifiable Data Breaches scheme. |
If this happens…
Someone steals Our Nests's database
Yes
We only ever store a scrambled version of your logins. The key to unscramble them is made from your passphrase, which we never receive and never store.
If this happens…
Someone steals a backup of Our Nests's database
Yes
Same reason. A backup contains the same scrambled data and no key.
If this happens…
Someone who works on Our Nests gets curious about your family
Yes, for the vault
Nobody at Our Nests can read your vault. Not a support person, not an administrator, not the person who wrote the code. There is no “admin override” button, because there is no mechanism for one to exist. But: your calendar, your children’s schedule, and the addresses you have saved are not scrambled, so they are protected by access rules rather than by maths. A determined insider with the right credentials could reach those.
If this happens…
A court orders Our Nests to hand over your vault
Yes
We would have to comply with a valid order, and what we would hand over is the scrambled data. We cannot produce your passwords because we cannot unscramble them. But: we can be compelled to hand over your calendar, custody schedule, addresses and therapy details — and we would have to.
If this happens…
Our Nests's hosting provider is breached
Yes, for the vault
They hold the same scrambled data we do. Your calendar and addresses would be exposed.
If this happens…
Someone guesses or steals your Our Nests password and signs in as you
Yes, for the vault
Signing in does not open the vault. The vault needs your passphrase, which is separate and which we do not hold. They would see your calendar and addresses.
If this happens…
You lose your phone while you are signed in
Yes, for the vault
The vault locks itself after five minutes, and whenever you switch away from the app. Whoever has the phone would need your passphrase. They could see your calendar until the session expires — which is why you should use “sign out everywhere” from another device.
If this happens…
Someone gets into your email
Yes, for the vault
Email cannot recover your vault. It cannot recover your account either without your second factor.
If this happens…
You forget your passphrase
You can still get in — with your Recovery Kit
That printed sheet is a second, independent key.
If this happens…
You forget your passphrase AND lose your Recovery Kit
No — and neither can we
Your vault is gone, permanently. We are not being unhelpful; there is genuinely no copy. This is the cost of nobody else being able to read it.
If this happens…
Someone attacks Our Nests’s website code and changes it (a "malicious deployment")
NO — a limitation we cannot protect against
Our Nests runs in your browser as code we send you each time you open it. If someone replaced that code with a version that quietly copies your passphrase as you type it, the encryption would not help — the code doing the encrypting would be the code stealing it. This is the biggest limitation of building Our Nests as a website instead of an app-store app.
If this happens…
An attacker manages to inject their own code into a Our Nests page (a "cross-site scripting" bug)
NO — a limitation we cannot protect against
Same reason. We work hard to make this impossible (see below), but "hard" is not "impossible".
If this happens…
A piece of open-source code Our Nests uses is tampered with by its author or a hacker
NO — a limitation we cannot protect against
Same reason — it would become part of the code running in your browser.
If this happens…
Your phone or computer has spyware or a keylogger on it
NO — a limitation we cannot protect against
Anything typed on a compromised device can be captured before Our Nests ever sees it. No website or app can fix this.
If this happens…
Someone is standing next to you demanding your passphrase
NO — a limitation we cannot protect against
No technology can protect you from this. If you are in that situation, 1800RESPECT (1800 737 732) is a free, confidential counselling service you can call any time of day or night — and you can destroy your vault from Settings if you need to.
If this happens…
Your calendar, your children’s schedule, or an address you saved
Not encrypted the way the vault is
These are shared with your co-parent, sorted and displayed, so they cannot be scrambled in the same way. They are protected by strict access rules enforced in the database, but a breach of our systems would expose them. Telling you if that happened is not a courtesy — it is a legal obligation under Australia’s Notifiable Data Breaches scheme.
What we do about the rows marked NO
We cannot eliminate them — nothing can, for a website that has to re-send you its own code every time you open it (see the recommendation below). We can make them expensive and noisy. Here is exactly what is true today, not what we intend to be true.
In place today
- The vault pages are locked down so that no code from anywhere but Our Nestscan run on them, and so they cannot send data anywhere but Our Nests’s own servers. This is enforced by the browser itself on every page load, not just tested for.
- The encryption code lives in one small module with one narrow doorway in and out. That boundary is enforced by a lint rule, not just observed by convention — code elsewhere in the app is not permitted to reach into it, and a build fails if it tries.
Intended, and not yet done
Listing these as facts would be worse than admitting the gap, because the gap is discoverable and the dishonesty is what would ruin your ability to trust anything else on this page. None of the following is true yet:
- We do not yet get an alert when the lock-down above is violated.
- We do not yet block install scripts in the code we depend on.
- We do not yet wait before adopting updates to that code, to let a tampered release get caught elsewhere first.
- Publishing a new version of Our Nests does not yet require a second person’s approval — this is currently a solo project.
- An outside security firm has not yet tested any of this.
- We do not yet publish an address where someone can report a security problem they find.
This section will be updated the moment any one of these becomes true — not before.