Trust and security
Who runs Family Office, where your data lives and how it is protected, what is never done with it, and how you take it with you. Each line describes how the application works today.
Who runs it
Family Office is made and run by Unicorn Real Estate Ltd, a private limited company registered in England and Wales and registered with the Information Commissioner's Office (ICO), the UK's data protection authority.
Registered in England and Wales, company no. 11020140. Registered office: 27 Old Gloucester Street, Monomark House, London WC1N 3AX. ICO registration no. C2045891.
Where your data lives
Your data is stored on Amazon Web Services in the London region (eu-west-2), and so are its backups. Who handles some of it outside the United Kingdom (a few providers, and the operator), and why, is in the privacy policy.
How it is protected
At rest: the storage is encrypted and closed to the public. Bank tokens and two-factor secrets are encrypted a second time, with a key of their own.
Each document in your vault is encrypted again with a key of its own, and checked for malware before anyone else can open it.
In transit: HTTPS only. A visit by plain HTTP is redirected to HTTPS, and the connection is encrypted on every hop from your browser to the application.
Passwords are hashed with scrypt, and sign-in is blocked for 15 minutes after five failed attempts. Two-factor sign-in is open to every account: a passkey, an authenticator app or a code by e-mail, with single-use recovery codes. Linking a bank needs a passkey or an authenticator app.
Bank links only read
Bank links go through Plaid and only read what your bank reports about the accounts you select. You type your bank password on Plaid's own screen, never in Family Office. The application asks for no payment or transfer access, so it cannot move money.
What is never done with it
Your data is not sold, not shared for advertising and not used to train any model. There are no cookies for advertising, analytics or tracking: the one cookie keeps your browser on the same copy of the application and holds nothing about you.
Take it with you
Your plan downloads as a JSON file (Profile, then Export plan) that Family Office can import again. The report downloads as a web page you can print, and the three financial statements download as a CSV file that opens in Excel.
Budgeting's transactions download as a CSV file too.
Delete it
Profile, then Delete account, deletes your data (an account two people sign in to after a short wait, so the other can cancel it), revokes every bank connection and sends you a confirmation. The storage's prior copies are erased within 90 days. Invoices and payment records, and the server's logs, are kept for the periods the privacy policy gives.
Hand it over
If you set up the hand-over (Profile, then Hand-over) and do not sign in for the waiting time you chose, Family Office e-mails you several times to check in. Only if none is answered do the people you named, who have confirmed their address, receive what you chose, opened with a code you give them in person. That code is stored only as a hash.
Read-only API
API tokens can only read, never change anything, and are stored only as a hash. A revoked token stops within 30 seconds, a new password revokes every token, and deleting your account deletes them all.