Security by design
AAK Legacy combines on-device encryption, native Apple protections, encrypted cloud copies, minimum-knowledge infrastructure, and a distributed delivery process. Each layer limits what the next one can see or do.
Your Legacy leaves the iPhone already encrypted. AAK, guardians, and the infrastructure that stores it have no master key capable of reading it.
Text, the content's own metadata (such as titles or tags), and attachments are protected locally before they are persisted or synchronized. CloudKit and AAK infrastructure receive that content already encrypted, not the readable original. Operational metadata is not covered by the end-to-end encryption applied to content, although the infrastructure protects it during transmission and storage — the detail is in our Privacy Policy.
The Root Key → Space KEK → Item Key → DEK hierarchy compartmentalizes the Legacy. Each of the five spaces has its own cryptographic material and each item is protected with its own key, limiting the impact of an isolated failure.
Sensitive device material is kept through iOS Keychain. Apple documents AES-256-GCM protection and Secure Enclave-mediated access for Keychain secrets. Face ID or the device passcode authorizes locally: AAK never receives or stores biometric data.
Sign in with Apple authenticates the account, while AAK's internal identifier remains separate from Legacy keys. The owner's encrypted copy synchronizes through their private CloudKit database, inside an app-isolated container.
The backend handles only necessary operational data, verifications, and already-encrypted delivery packages. Cloudflare D1 adds AES-256-GCM encryption at rest and TLS in transit. This is an extra layer; Zero Knowledge does not depend on it.
Activation requires distributed verification: no guardian can decide or read alone. Once the process is satisfied, each recipient can receive only the encrypted package assigned by the owner.
The Recovery Kit contains a random 256-bit secret created on the device. AAK keeps no usable copy. It can therefore restore the owner's access, but AAK, Apple, and support cannot bypass its protection.
AAK Legacy is designed and managed from Spain under GDPR principles. We have directly checked the real production configuration and confirmed that Cloudflare D1's databases run in the WEUR (Western Europe) region with no “jurisdiction” parameter configured: per Cloudflare's official documentation, that makes the region a performance preference, not a legal guarantee of exclusive EU residency. Apple, Cloudflare, Stripe Identity, and Resend all publicly state they use Standard Contractual Clauses (and, where applicable, the EU-U.S. Data Privacy Framework) for their international transfers; the provider-by-provider detail is in our Privacy Policy.
Privacy by design
AAK Legacy's policy starts with one simple rule: collect as little as possible, separate identity from content, and never build a business model around the user's private life.
Read the privacy policyAAK · SECURITY
These external references describe the platform and infrastructure protections AAK Legacy relies on. Its own cryptographic design adds an earlier, independent layer.