Security at Essence: how your data is protected
Your documents are encrypted on your device and shared one field at a time, under consent you can withdraw. Each country runs its own instance, and erasure works by destroying keys.
When you put a passport or a bank statement into an app, the first thing to know is who else can read it. On Essence, your documents are readable by you and by the people you choose to share with, and not by the platform in between. That comes from how the platform is built, and the protection starts on your own device.
Encrypted before it leaves your device
Your documents are encrypted with AES-256-GCM in the app you use, before anything leaves your device. In a web browser that happens in a dedicated worker; on a phone, keys are kept in the device's keychain or keystore. The keys that protect your content are created on your device. For the documents and fields in your vault, Essence holds no key capable of decrypting them, whether in escrow or under a support process. Someone who broke into our servers would find ciphertext.
Each document's details are bound to its ciphertext, so if anyone alters either, decryption fails instead of producing something misleading.
Essence does hold keys of its own, for secure connections, for signing sign-in tokens and for the platform's own records. They are kept apart from the keys that protect your content, and they cannot open it.
Stored content is then protected a second time. The database and file storage are encrypted at rest, backups keep both layers, so a restored backup is still ciphertext, and connections use TLS 1.3 where they can, with nothing below TLS 1.2 accepted.
Shared one field at a time
Each field in a document is encrypted separately, so you can share your date of birth without sharing the passport it came from. Your device prepares access for the recipient, and the recipient's device does the decrypting. The server carries out your decision without ever holding a usable key.
Every share rests on a consent record, one for each field. A grant can carry an expiry, a maximum number of accesses, and whether the recipient may download, print or forward. It can also record a purpose, a lawful basis and how long the recipient may keep the data.
You can revoke a whole grant or a single field, and on your own instance it takes effect at once. When you withdraw, the platform seals a snapshot of the grant as it stood, so there is a fixed record of what you had agreed to.
Kept in its own country
Each country's instance of Essence is a complete, separate deployment of the platform, with its own databases, its own keys and its own certificate chain. The separation is physical, not a filter on a shared table.
Vault content never goes to our central service. That service runs sign-in, so it holds account records such as your email address, but not what is in your vault. Personal data moves between two countries only when a person starts a cross-border action, under their consent, and only as much as that action needs.
Instances do not trust each other because they can reach each other. Trust is an explicit decision that can be withdrawn, and an instance that has been removed cannot draw data from the others.
Protected sign-in
Getting into an account is protected in layers. The platform supports multi-factor authentication by authenticator app, text message or backup code, and sign-in with passkeys. Organisations can bring their own sign-in through SAML 2.0 or OpenID Connect single sign-on. Repeated failed attempts lead to account lockout or a growing delay, which slows anyone trying to guess their way in.
Because nobody at Essence can reset the key to your vault, the way back in is something you hold. Since our September release you can save a 24-word recovery phrase. The server stores only a proof derived from it, never the phrase itself.
A record that only grows
The platform keeps a record of who did what, and it is append-only: entries are added, and nothing in the platform's code changes or deletes them. It covers the people who run the platform as well as the people who use it.
You can see your own access history, and each share has a history that shows when it was withdrawn. For an organisation, that is a trail to point to when it is asked how a piece of data was obtained and on what terms.
Erased by destroying keys
When data has to go, the platform does not rely on finding every copy. It is designed to destroy the keys instead, so copies left in backups or replicas cannot be read. The encryption that protected your data becomes the means of removing it.
How we evidence all of this for your assessors is set out in Assurance at Essence.
For you, all of this means documents that you and the people you choose can read, and the platform cannot. If you are weighing up the platform and want to go through any of this in more detail, we would be glad to talk.
Last reviewed 8 October 2026