Security, stated plainly

Four principles

Secure sign-in

Sign in with an email and password, or use your existing Google or Microsoft account. Passwords are hashed with bcrypt and checked against known-breached password lists at sign-up. They are never stored in a readable form. Add time-based two-factor authentication for another layer.

• Two-factor authenticationTime-based codes (TOTP) with single-use recovery codes.
• Brute-force protectionRate limiting and automatic lockout on repeated failed sign-ins.

Application-level encryption

Traffic is encrypted in transit over HTTPS. The most sensitive fields, names, research notes, project and tree names, and source citations, are additionally encrypted with AES-256 before they are written to the database, so they remain unreadable even to someone with direct database access.

• TLS 1.2 minimumAll connections, with TLS 1.3 supported.
• Ciphertext at restNames and notes are stored as ciphertext, not plain text.

To be precise: CanopyLink holds the encryption keys, so this is not end-to-end encryption. Our systems can decrypt data in order to run the service. Dates, place names, relationship structure and uploaded files are protected by transport encryption, access control and storage-layer encryption rather than this additional field-level layer.

Access control

Every project is private by default. When you share a project, you choose whether each person can view only or view and edit. Only you, the project owner, can delete it. Every request is authorised on the server, so access is enforced rather than assumed.

• Invite-only sharingView-only or edit permission, per person.
• RevocableRemove someone's access at any time.

Data integrity

Family tree data requires precise relationships. CanopyLink enforces referential integrity at the database level with foreign key constraints, ensuring parent-child, spouse, and sibling relationships always remain consistent and accurate.

• Foreign key constraintsOn every relationship.
• Two layers of validationAt the application and at the database.

Infrastructure and practices

• HTTPS everywhereAll connections use TLS, with HTTP Strict Transport Security enforced so browsers refuse to connect any other way.
• Nightly backupsThe database is backed up every night to separate, access-controlled storage, with alerting if a backup ever fails.
• CSRF and XSS protectionBuilt on Laravel's security framework with CSRF tokens, input sanitisation, and output escaping on every page.
• Input validationAll user input is validated and sanitised before processing. Parameterised queries prevent SQL injection.
• Uptime monitoringRound-the-clock monitoring with automated alerts. See the server status page.
• Data portabilityExport your projects as GEDCOM files at any time. Your data is never locked in.

Your rights

We believe your data belongs to you. Always.

• Right to accessView and export all of your data at any time through your account dashboard.
• Right to deletionDelete your projects or your entire account at any time. Deletion is immediate and permanent, with no recycle bin, and uploaded documents and photos are removed from storage too. Deleted data then ages out of our rolling backups.
• Right to portabilityExport your trees as industry-standard GEDCOM files that work with any other genealogy software.
• No data selling, no AI trainingWe will never sell, share, or monetise your genealogical data. CanopyLink has no AI or large language model integration of any kind. Your trees, names and notes are never sent to any AI service.