Security & privacy

Your family. Your data.

Stresfri holds calendars, faces, school addresses. That's a lot of trust. Here's exactly how we earn it, no hand-waving.

GDPR UK-GDPR COPPA SOC 2 Type I EU / UK residency
Encrypted end to end in transit

Every request between your device and Stresfri travels over TLS 1.3. Your household's data is never in the clear on the wire.

EU / UK data residency

Household data is stored in the EU by default, your row in our database sits in London or Frankfurt, never in the US, unless you explicitly opt into a US region.

Face ID / Touch ID + MFA

Biometric unlock on iOS and Android. TOTP authenticator support on the web. A stolen laptop can't just log into your family.

Kids' data, kids' rules

Children under 13 (US COPPA) and under 16 (UK/EU GDPR-K) get a locked-down default: no analytics, no ads, no AI training on their content, ever.

Per-member permissions

Roles decide who sees the wallet, who can redeem points, who can invite. A grandparent doesn't need to see the household budget.

One-click export & delete

Download your family's entire history as JSON. Delete your account and every scrap goes with it, backups included, within 30 days.

The specifics

No security theatre. Just answers.

Every question we've been asked by a customer's IT team, a school procurement officer, or a lawyer for a foster network.

Do you use my family's data to train AI?
๏ผ‹

No. We use Anthropic's Claude for the AI composer, and their zero-retention data-processing agreement means our prompts and your household's rows are never used to train any model.

Where are the backups stored?
๏ผ‹

Encrypted at rest in the same region as the primary, EU/UK by default. Backup keys are rotated monthly and never leave HSM.

Can grandparents see everything?
๏ผ‹

Only what the household admin gives them permission to see. Roles: Admin, Adult, Kid, Carer. Carer sees calendar + chores, not wallet or budget.

What if I stop paying?
๏ผ‹

You keep the Free tier. Your calendar, chores and lists stay. AI, meal planner and multi-household roll back but nothing is deleted. Downgrade doesn't lose history.

Are you SOC 2 / ISO 27001?
๏ผ‹

SOC 2 Type I completed; Type II audit in progress. ISO 27001 evidence pack available on request for enterprise-family customers (schools, family offices, foster networks).

Have a security question we haven't answered?

Our security lead answers procurement questionnaires personally. Real reply, usually inside a day.