NextCalm Security Architecture Whitepaper

AES stands for Advanced Encryption Standard. The 256 refers to the key length in bits. It is the standard adopted by the United States government for classified information, used by financial institutions worldwide, and endorsed by security agencies including NIST, NSA, and GCHQ.

The number of possible AES-256 encryption keys is 2^256: a figure larger than the estimated number of atoms in the observable universe. A brute-force attack running on every computer on Earth simultaneously would take longer than the current age of the universe to succeed.

Every item in your NextCalm vault is protected by this standard.

When you store content in your NextCalm vault, it is encrypted using AES-256 before being written to our servers. The data stored on our servers is not readable as plain text. Accessing your vault requires valid authentication. Without it, the encrypted data cannot be used.

All data moving between your device and our servers travels over a TLS-encrypted connection. This protects your information from interception during transmission across web, iOS, and Android.

Your encryption key is managed securely within the NextCalm platform. We are committed to ensuring that access to vault content requires your explicit authentication and cannot occur without it.

Guardian Bot is NextCalm's automated delivery system. When your configured delivery threshold is triggered, Guardian Bot releases access to your designated recipients based on the permissions you set at setup.

Guardian Bot operates on access permissions and delivery configuration. It does not read, interpret, or process the content of your vault. This separation between access management and content is a deliberate architectural decision to limit the surface area of automated access to your information.

For questions about your rights under any of these frameworks, contact privacy@nextcalm.com.

Your encrypted vault data is stored on our servers and accessible through your authenticated account. NextCalm manages access permissions and delivery configuration. We do not use your vault content for any purpose other than making it available to you and, where you have configured it, to your designated recipients through Guardian Bot.

Your data is yours. You can request export of your data at any time. When you delete your account, your personal data and vault contents are removed from our systems in accordance with our data retention policy. Confirmation of deletion is sent to your registered email address.

For specific questions about data retention timelines or deletion procedures, contact hello@nextcalm.com.

NextCalm will comply with valid legal orders in the jurisdictions where we operate. We will notify affected users where we are legally permitted to do so. We will not voluntarily share user data with any third party outside of legal obligation.

We hold the minimum data necessary to operate the service. Access to vault content requires valid authentication credentials.

Yes. Every item stored in your NextCalm vault is encrypted using AES-256. Data in transit between your device and our servers is protected by TLS. Your information is not stored or transmitted as plain text.

Access to vault content requires valid user authentication. NextCalm operates with internal access controls that restrict who can access what within our infrastructure. Accessing a user's vault content without their credentials is not a routine operational capability.

Yes. All data transmission uses TLS encryption. Data moving between your device and our servers is protected against interception regardless of the network you are on.

No. NextCalm is a subscription service. We have no advertising relationships and no commercial arrangements that involve selling or sharing user data with third parties.

Your vault content and personal data are removed from our systems when you delete your account. You will receive confirmation by email. For specific questions about data handling, contact hello@nextcalm.com.

Guardian Bot operates on access permissions, not on content. When your configured delivery threshold is triggered, it releases access to your designated recipients based on the permissions you established at setup. It does not read or process the content of your vault. Recipients access their designated content through their own authenticated sessions.

NextCalm provides account recovery options to help you regain access. Contact support@nextcalm.com and our team will guide you through the recovery process.

Security is a continuous commitment, not a fixed state. We are actively developing additional security capabilities including enhanced access controls, audit logging, and expanded encryption options. We will publish updates as these become available. If you have specific security requirements, contact security@nextcalm.com to discuss what is in place and what is planned.