Security
Updated September 13, 2026 · How LIFE1 protects your information
What follows is what we actually do today. We describe our controls plainly and do not claim certifications we do not hold.
1. Encryption
- In transit: every connection between the app, the watch companion, the website and our servers uses TLS 1.2 or higher.
- At rest: databases, object storage and backups in our cloud account are encrypted with AES-256 using provider-managed keys.
- Passwords are never stored; we keep a salted PBKDF2 hash.
2. Authentication and authorization
- Sessions use signed tokens (HMAC-SHA256) issued by our authentication service. Every request to a protected endpoint verifies the signature and the user identity in the token; requests without a valid token are rejected.
- Each record is scoped to the user who created it. One account cannot read or change another account's data.
- Sign in with Apple is supported. Account deletion removes server data and the session token from the device keychain.
3. Infrastructure
- Hosted on Amazon Web Services in the US East region, using managed serverless compute, managed databases and object storage.
- Secrets such as signing keys live in AWS Secrets Manager, not in code or configuration files.
- Least-privilege roles for services and staff; production access is limited to named individuals.
- AI processing for food scans and meal plans runs through Amazon Bedrock inside our account; prompts and outputs are not used to train foundation models.
- Usage is metered per user to detect abuse.
4. On your device
- Health data read from Apple Health stays under Apple's sandbox and permission system; you can revoke access at any time.
- Session tokens are stored in the iOS Keychain. Local data is protected by iOS data protection when your device is locked.
- Crash and performance reports are collected with Apple's MetricKit and contain technical information, not your health records.
5. Monitoring and response
- Server and access logging, error and crash telemetry, and alerting on abnormal patterns.
- A documented incident response process. If a breach creates a real risk of significant harm, we notify affected users and the relevant authorities as the law requires.
- Dependencies and platform SDKs are kept current with each app release.
6. Compliance posture
LIFE1 follows PIPEDA and Quebec Law 25 in Canada, the CCPA/CPRA in California, and is designed to GDPR principles. We are not a HIPAA covered entity and do not hold SOC 2 or ISO 27001 certification at this time. We will update this page if that changes.
7. Responsible disclosure
If you believe you have found a security vulnerability, email help@life1.ai with the subject "Security". Please give us reasonable time to investigate and fix before public disclosure; we will acknowledge your report within two business days and keep you informed. Do not access other users' data or degrade the Service while testing.
life1