Security
What actually protects
your mother’s data.
Specifics, not adjectives. Every claim below is one you could check, and one we would have to answer for.
There is no password to steal
Most breaches you read about are password breaches. Somebody gets a database of email addresses and password hashes, cracks the weak ones, and tries them everywhere else — because people reuse passwords.
Pruuf never created that database. There are no accounts, no usernames, no passwords and no password reset emails, so there is nothing of that kind to leak, phish, guess, or stuff into another site. Two people are connected by a six-character code that does one job and grants nothing else.
We built it that way so an 82-year-old would never be locked out at eleven at night. That it removes the most commonly breached thing in software is a genuine consequence, not a marketing claim.
A check-in can’t be forged
When your mother taps I’M OK, her device signs that check-in with a private key created inside the Secure Enclave — the separate security chip in her iPhone, iPad or Apple Watch. That key cannot be exported, copied to another device, or recovered from a backup. It never leaves the chip; the signing happens there.
Our server checks that signature before recording the check-in as verified. Which means a check-in could not have been produced by anybody not physically holding her unlocked device — including us. We could write a row in our own database; we could not produce a signature for it, and the gap would stay visible in the record.
The signature covers the day as well as the moment, so yesterday’s check-in cannot be replayed as today’s.
And if the signing fails, the check-in still goes. On an older device, or after a restore, a check-in is recorded without a signature rather than not recorded at all. A family told their mother missed a day she did not miss — because of a cryptographic detail — would be a far worse product than one with no signatures.
The database refuses, not the app
Every request is filtered by row-level security inside PostgreSQL itself, keyed to the account making it. One family’s data is not kept separate because our application code remembers to check — it is kept separate because the database declines to return it.
The difference matters. Application checks are the ones that get forgotten in the new feature written at midnight. This one cannot be forgotten, because it is not written per feature.
Encrypted in transit and at rest
Everything between the app and our servers travels over TLS. Everything stored is encrypted on disk. This is the ordinary, expected standard rather than anything clever, and we mention it because its absence would matter.
Yes, it runs on a server. That’s the point.
Almost everything calling itself a check-in app is a reminder running on the phone of the person being checked on. If that phone is flat, off, or at the bottom of a handbag, the app has nothing to say — and silence is indistinguishable from a good day.
Pruuf’s alerts run on our servers. At her check-in time the server looks for a tap, and tells her family if there isn’t one, whatever state her phone is in. That is the entire product, and it is only possible because a system that is not her phone is watching.
It is also why we do not claim end-to-end encryption. End-to-end would mean our servers cannot read her check-ins — and a server that cannot read them cannot notice one is missing. Anybody offering you both is describing something that does not work. We would rather tell you which one we chose, and why.
What we never collect
- No location. Not optional, not buried in a setting. Pruuf never asks for it and could not show it if it wanted to.
- No camera, microphone or health data.
- No advertising or analytics trackers — in the app, or on this website.
- Nothing sold or shared. There is no data business here; the subscription is the business.
For care providers
Signed check-ins are the reason the audit trail is worth something. A verified record answers “how do you know that was really the client?” with cryptography rather than with a policy. The integrity report shows verified and unverified counts side by side — a report that hid its own gaps would not be an audit trail.
Found something?
If you believe you have found a security problem, please tell us before telling anyone else, and we will reply within one business day. We will not threaten you, and we will credit you if you would like us to.
No system is perfectly secure and we will not pretend otherwise. What we will do is describe what we actually built, accurately, and fix what we get wrong.