Skip to content
Join the waitlist

Security

How WHIG protects what you own

For the technically minded. Plain language, no hand-waving.

The short version

  • Your finished inventory is encrypted with a key only you hold. We cannot read it.
  • Our database holds account and processing details, room labels and cryptographic fingerprints, not your item-by-item inventory.
  • Your walkthrough video is processed in an isolated environment, then deleted after your app confirms receipt.
  • The original processing record is digitally signed and can be verified independently of WHIG.

Below is the honest, detailed version, including the one window where the video is readable, because we would rather tell you than have you find out.

How your walkthrough flows

  1. You record. The walkthrough is captured on your phone and uploaded over an encrypted connection (TLS).
  2. We process, in isolation. To turn video and speech into an inventory, the pipeline has to read the walkthrough. This happens in an isolated processing environment, not in our database, with temporary files deleted after your app confirms receipt. This is the one window where the content is readable. We are explicit about it because a claim that we “never see anything” would be untrue.
  3. You receive. Your inventory is encrypted on your device. You can save an encrypted backup file to Google Drive, iCloud or another location offered by your phone.
  4. We delete. After your app confirms receipt, we delete temporary video, audio and derived files and check the deletion results. An independent sweep runs every 15 minutes to remove temporary files older than 23 hours, including abandoned uploads. Storage lifecycle expiry is an additional safety net. Service outages can delay deletion; failed or missed sweeps raise operational alarms.

Encryption and keys

Your inventory is encrypted on-device with a 256-bit key (AES-256-GCM). That key is generated on your phone, protected by your device's secure storage, and is never transmitted to WHIG. We do not hold it and cannot derive it, so we cannot decrypt your inventory.

Save your encrypted backup file and keep its recovery code separately, for example in a password manager. You need both to restore on another device. Your WHIG account password cannot unlock the file, and WHIG cannot recover a lost code. Backups are saved manually: save a fresh copy after changing your inventory.

What is on our servers, and what is never on them

Our database (Supabase) holds only the minimum needed to run the service:

  • Your account and processing-minutes balance.
  • Room labels and non-sensitive session metadata.
  • Anonymised category aggregates, never tied to you, used to improve regional estimates (and only once a bin has enough samples to be non-identifying).
  • Cryptographic hashes and signatures that prove your record is genuine.

It never holds item names, brands, model numbers, individual values, your transcript, or images of your items. Account and processing metadata are retained, but your item-by-item inventory is not stored in this database.

The Evidence Package seal

As your walkthrough is processed, each step produces a SHA-256 hash of its output. Each hash is signed at the time it happens with an asymmetric key (ECDSA, NIST P-256) whose private half lives in AWS KMS and is never exported. The result is a chain of signed, timestamped fingerprints of the original processing session. Later edits, added photos and receipts remain separate from that signed original.

The Evidence Package carries these signatures, so the seal can be verified independently of WHIG, by you or by an assessor. Paste your package’s inventory.json at whig.app/verify to check every signature against our published public key, right in your browser. Nothing is uploaded.

What WHIG is not

WHIG produces estimates and documentation, not professional valuations. Specialist items (jewellery, art, watches, antiques) are flagged for a qualified valuer rather than guessed at. The seal checks the integrity of the signed original, not ownership or the accuracy of estimates. It does not replace a formal valuation where one is required.

Questions, or a responsible-disclosure report? hello@whig.app.