Privacy
This is a family archive. We treat it like one.
isna holds passports, health details and invoices. It is not a notes app. This page says what is actually done, without generalities about "bank-grade security".
Where the data lives
On a server in Finland (Hetzner, Helsinki). Database, files and backups, all in the EU. No transfers to third countries beyond what is listed on Subprocessors.
Who can reach it
The system has been multi-tenant since the first line of code: each household is separated by a filter applied in the database itself, not in the interface. There are automated tests that deliberately try to see another household's data and must fail — if they ever passed, the release would not ship.
Administrative access to one household's data exists technically, as it does at any service somebody maintains, and it is used only when you ask for support. We do not read documents, we do not train models on your data, and there is no internal tool for browsing family content.
Sign-in and accounts
- The session is an HttpOnly cookie, not a token sitting in browser storage.
- Two-factor sign-in (TOTP) can be switched on in settings.
- A family invitation is a signed link that expires.
- Four roles: owner, adult, limited (teenager) and viewer. The limited role never sees the money and never deletes anything.
Per-item visibility
Family, adults only, private, or tied to a single member. The rule is applied in the database query — once, in one place — rather than screen by screen. Health data is adults-only by default and does not appear in search or the activity log unless explicitly requested.
Files
Uploads go straight to object storage through a signed link valid for ten minutes. The file type is established by reading the bytes, not by trusting the browser. Virus scanning is available. Downloads use a link valid for five minutes and are recorded in the activity log.
Backups
The database is copied to object storage every night, with thirty-day retention. There is a restore script that loads into a scratch database first, so a restore can be tested without risking production.
Your data is yours
- Export: one ZIP with every record as JSON and every file you uploaded. Any time, without asking support.
- Deletion: deleting a household asks you to type its name, then waits seven days and can be cancelled throughout. After that it also leaves the backups within their retention cycle.
- Trash: deleted items stay for thirty days before they are removed for good.
Children's data
Children in isna usually have no account — they are records kept by a parent. When a teenager does get an account, it is a limited one: their own records and the family's, no one else's health data, no finances. Details in the Privacy policy.
What isna will never do
- It will never read your bank account.
- It will never track where your children are.
- It will never have a feed, likes or chat.
- It will never sell your data or show you ads.
- It will never score who did more chores.
Reporting a vulnerability
Found something? Write to info@isna.app. We answer within two working days, and we do not go after anyone for reporting in good faith.
Start with the one deadline you cannot afford to miss.
Set your family up in two minutes. Thirty days of everything, and it does not ask for a card.