Security

NeverExpiry aims to protect information through appropriate technical and organisational safeguards. Our security approach includes principles such as: • limiting unnecessary access; • protecting account authentication; • protecting information during transmission; • controlling access to private documents; • separating customer information appropriately; • protecting sensitive credentials; • minimising unnecessary copies of information; • reducing unnecessary sensitive information in operational logs; • monitoring for misuse or security incidents; • considering security when developing new features; and • continuously reviewing security as technology and risks change. Security is an ongoing process rather than a one-time task.

NeverExpiry's security approach is intended to support: Confidentiality — private information should only be available to authorised users, systems and appropriately authorised personnel. Integrity — information should be protected against unauthorised or accidental alteration. Availability — systems and information should remain appropriately available and recoverable where reasonably practicable. No online service can guarantee complete protection from every possible security threat or uninterrupted availability.

Your NeverExpiry document library is intended to remain private to your authorised account. NeverExpiry personnel do not routinely browse, inspect or access customers' private document libraries. Access to private documents is controlled through authenticated account access and applicable technical and organisational safeguards. Limited authorised access may occur only where reasonably necessary to: • operate or support the service; • investigate a technical problem; • investigate suspected fraud or misuse; • investigate a security incident; • comply with a binding legal requirement; • respond to a safeguarding concern; or • protect users, NeverExpiry or the public from a serious security or safety risk. Where authorised access is necessary, it should be limited to information reasonably required for that purpose.

Private documents stored within NeverExpiry are not intended to be: • published publicly; • indexed by public search engines; • displayed publicly in the NeverExpiry catalogue; • made available to unrelated NeverExpiry users; • used for behavioural advertising; or • intentionally exposed through public website pages. Generic document-type information used to operate or improve the NeverExpiry catalogue should remain separate from private customer document contents.

Uploading or storing a document in NeverExpiry does not transfer ownership of that document to NeverExpiry. Users retain the rights they already have in their documents and information. NeverExpiry processes customer information only for purposes connected with providing, operating, securing and supporting the service, subject to applicable legal requirements.

NeverExpiry is designed so that one user should not be able to access another user's private information merely by knowing or guessing: • a document name; • file identifier; • record identifier; • URL; • account reference; or • similar technical information. Appropriate authentication, application, database and storage controls should be used to separate customer information.

NeverExpiry uses secure web connections to protect information transmitted between supported browsers and the NeverExpiry service. Users should ensure they are accessing the genuine NeverExpiry website before entering credentials or uploading sensitive information.

NeverExpiry is designed as a private document-management and reminder service. Documents may therefore remain stored while the user chooses to retain them in their account, subject to applicable: • account settings; • plan limits; • retention arrangements; • deletion requests; • privacy requirements; and • legal requirements. This differs from a temporary file-conversion service.

Stored information should be protected using safeguards appropriate to the type and sensitivity of the information. Depending on the relevant system, safeguards may include: • authenticated access; • private storage; • database access controls; • file-access controls; • account permissions; • restricted administrative access; • infrastructure security; and • other appropriate protective measures.

NeverExpiry uses authentication controls to restrict access to customer accounts. Depending on the authentication functionality currently implemented, these may include: • passwords; • authentication tokens; • secure sessions; • email verification; • password-reset processes; • account-security checks; and • other appropriate authentication controls. NeverExpiry should not intentionally store users' passwords as readable plain text.

The account owner is responsible for taking reasonable steps to keep their NeverExpiry login credentials secure. Users should: • use a strong and unique password; • keep their password private; • avoid reusing the same password across unrelated services; • protect access to the email account linked to NeverExpiry; • keep authentication and recovery information secure; • not unnecessarily share authentication codes or login details; • sign out after using shared or public devices; and • change or reset credentials promptly if compromise is suspected. The security of the user's password, linked email account and recovery credentials is also dependent on the user's own security practices. NeverExpiry is not responsible for unauthorised account access caused by a user's failure to take reasonable steps to protect their credentials, except where responsibility cannot lawfully be excluded.

NeverExpiry support cannot retrieve or disclose a user's existing password. If you forget your password, use the: Forgot password option on the NeverExpiry sign-in page and follow the secure password-reset process. Do not ask NeverExpiry to send or tell you your existing password. For security reasons, existing passwords will not be disclosed or retrieved through ordinary support communications. Users are responsible for maintaining access to the email account or other recovery method associated with their NeverExpiry account. If the linked email account or NeverExpiry account may have been compromised, the user should reset relevant credentials promptly.

Users should never send their NeverExpiry password through: • email; • support communications; • uploaded documents; • ordinary messages; or • any other unnecessary communication. NeverExpiry will not ask a user to provide their existing account password through these channels. Users should use the secure account authentication and password-reset functions provided by NeverExpiry.

Where NeverExpiry is used to store or manage documents belonging to a child, minor or dependant, responsibility for protecting the relevant account credentials remains with the appropriate: • parent; • guardian; • responsible adult; • carer; or • lawful representative. That person is responsible for taking reasonable steps to: • keep the account password secure; • protect the linked email account; • control who can access the account; • protect authentication and recovery information; • sign out from shared devices; • prevent unnecessary disclosure of the child's documents; and • maintain appropriate control over the child's or dependant's information. Storing documents belonging to a child, minor or dependant in NeverExpiry does not transfer the parent, guardian or responsible adult's security responsibilities to NeverExpiry.

NeverExpiry may use authentication tokens, session information or similar technologies to maintain secure signed-in access. Security-sensitive authentication information should be protected appropriately. Sessions or credentials may be restricted, invalidated or reset where compromise or suspicious activity is reasonably suspected.

Administrative access to NeverExpiry systems should be limited to people and systems that legitimately require that access. Where appropriate, access should follow principles such as: • least privilege; • restricted administrative permissions; • role-appropriate access; • protected credentials; • removal of unnecessary access; and • review of privileged access. Access should be changed or removed when it is no longer reasonably required.

People authorised to access NeverExpiry systems or information should only receive access appropriate to their legitimate role. Appropriate confidentiality and security obligations should apply. Private customer documents must not be accessed merely out of curiosity or for unrelated personal purposes.

Sensitive technical information may include: • database credentials; • storage credentials; • service secrets; • authentication secrets; • signing keys; • payment-related credentials; • infrastructure credentials; and • other privileged configuration information. Such credentials should be protected using appropriate technical mechanisms. Sensitive credentials should not intentionally be: • exposed publicly; • committed to public repositories; • shown on ordinary public pages; • unnecessarily recorded in logs; or • disclosed to people who do not need them. Compromised credentials should be revoked or replaced where appropriate.

Operating a secure online service requires technical and operational records. NeverExpiry may process limited information such as: • timestamps; • login and authentication events; • request information; • system errors; • diagnostic information; • security events; • device or browser information; • IP information; • performance information; and • relevant service activity. NeverExpiry aims to minimise sensitive information in routine logs and avoid recording private document contents where those contents are not required. Routine operational logs are not intended to operate as a duplicate document vault.

NeverExpiry may use reasonable security measures to identify: • repeated failed login attempts; • suspicious authentication activity; • abnormal traffic; • attempted unauthorised access; • automated attacks; • malicious requests; • fraud; • service abuse; • software errors; and • infrastructure problems. Reasonable protective measures may include: • rate limiting; • access restriction; • session termination; • credential reset; • request blocking; • temporary suspension; or • other proportionate security controls.

NeverExpiry may apply technical checks to uploaded files where appropriate. These may consider factors such as: • supported file type; • format; • file size; • corruption; • malformed content; • password protection; • technical compatibility; or • other conditions relevant to secure operation. Unsupported, malformed or potentially harmful files may be rejected. No automated file-checking system can guarantee detection of every harmful file.

Users must not knowingly upload: • malware; • viruses; • ransomware; • malicious scripts; • exploit files; • harmful code; or • files intended to attack NeverExpiry, another user or another system. NeverExpiry may restrict activity or take other protective action where reasonably necessary to protect users or infrastructure.

NeverExpiry may use OCR or other automated technologies to assist with functions such as: • text extraction; • document identification; • expiry-date extraction; • renewal-date extraction; • classification; • document organisation; and • other relevant features. Automated extraction can occasionally make mistakes. Users should verify important extracted information against the original document or authoritative source. Document contents should not be copied unnecessarily into unrelated operational logs or systems.

NeverExpiry may use AI-assisted functionality for appropriate features such as: • document classification; • information extraction; • document-type identification; • catalogue organisation; • translation; • user assistance; or • other disclosed functionality. NeverExpiry does not use private customer documents to train NeverExpiry proprietary AI models. Where an external specialist service is used, only information reasonably necessary for the selected function should be processed. Appropriate contractual, confidentiality, security and data-protection safeguards should apply. NeverExpiry will not make broader promises about an external provider's technical practices unless those commitments genuinely apply.

OCR, AI and other automated systems can sometimes: • misunderstand information; • extract the wrong date; • misclassify a document; • omit information; or • produce an inaccurate result. Users should check important information before relying upon it. Automated assistance does not remove the user's responsibility to verify important document information.

NeverExpiry aims to process only information reasonably necessary for the relevant functionality. When developing or operating features, NeverExpiry should consider whether: • less information can be processed; • only selected fields are required; • unnecessary copies can be avoided; • temporary information can be removed; • access can be restricted; and • unnecessary exposure can be reduced.

NeverExpiry may rely on specialist technology providers for functions required to operate the service. Depending on the service, these may support areas such as: • hosting; • infrastructure; • databases; • authentication; • document storage; • communications; • payments; • OCR; • AI-assisted processing; • monitoring; • security; or • backups. NeverExpiry aims to provide each service only with information reasonably necessary for the relevant function and to use appropriate safeguards where required.

No external service provider can guarantee that it will never experience: • a security incident; • outage; • vulnerability; • infrastructure failure; or • operational problem. Where a provider issue affects NeverExpiry, reasonable steps should be taken according to the circumstances to protect users, investigate the issue and restore affected functionality.

Payments and subscriptions may be processed through specialist payment services. NeverExpiry does not intend to store users' complete payment-card numbers or card security codes in its ordinary application database. Users should never send full card details or card security codes through ordinary email communications.

NeverExpiry may use backup, replication or recovery mechanisms appropriate to its infrastructure. Where backups contain customer information, those backups should be subject to appropriate security and access restrictions. Backups are intended to support: • resilience; • recovery; • restoration; and • business continuity, rather than ordinary browsing of customer documents.

Where information is deleted from active storage, protected technical backup copies may remain temporarily until removed or overwritten through normal backup processes. Backup information should not be treated as ordinary active customer storage after deletion. Further information about retention and deletion is provided in the Privacy Policy.

NeverExpiry aims to maintain reasonable arrangements for responding to: • infrastructure failure; • database problems; • storage problems; • software faults; • security incidents; and • other significant technical problems. Recovery may depend on the nature of the incident and the infrastructure and providers involved. NeverExpiry does not guarantee a particular recovery time unless a specific commitment has expressly been made.

If NeverExpiry becomes aware of suspected unauthorised access to an account, we will assess the circumstances and take appropriate protective and investigative steps within a reasonable timeframe, having regard to: • the nature of the incident; • its severity; • information available at the time; • potential impact on affected users; and • applicable legal requirements. Protective measures may include, where appropriate: • restricting affected sessions; • resetting or revoking credentials; • restricting account access; • investigating suspicious activity; • preserving relevant security information; • addressing identified vulnerabilities; and • taking reasonable steps to reduce further risk. Where the incident constitutes a reportable personal data breach, NeverExpiry will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by applicable law. Where a personal data breach is likely to result in a high risk to an affected individual, NeverExpiry will notify that individual without undue delay in accordance with applicable law and provide appropriate information about the breach and protective measures where required. Where notification to the relevant supervisory authority cannot be made within the legally applicable timeframe, NeverExpiry will provide reasons for the delay where required by law.

A cybersecurity or account-security incident does not automatically constitute a personal data breach. Where an incident involves personal information, NeverExpiry will assess: • what happened; • what information may be affected; • who may be affected; • the likely risks; • appropriate containment measures; • whether regulatory notification is required; and • whether affected individuals must be informed. NeverExpiry will maintain breach records where required by applicable law.

Where relevant information remains available, NeverExpiry may preserve or disclose information where required by: • applicable law; • a binding court order; • a lawful regulatory requirement; or • another legally binding request from an authorised authority. Relevant information may also be preserved where lawful, necessary and proportionate to address: • a credible security incident; • suspected serious fraud; • serious unlawful activity; • safeguarding concerns; or • a serious threat to individuals or public safety. Any exceptional preservation or disclosure should be limited to information reasonably necessary for the relevant purpose.

Security considerations should form part of NeverExpiry's development process. Depending on the feature, this may include: • minimising information processed; • limiting unnecessary data exposure; • reviewing authentication; • reviewing access controls; • reviewing database permissions; • reviewing storage permissions; • validating input; • protecting sensitive credentials; • considering abuse risks; • reviewing service providers; and • testing important changes before deployment.

NeverExpiry depends on software frameworks, libraries and infrastructure components. We aim to: • review important security updates; • keep important components reasonably current; • address material security issues; • remove unnecessary software where appropriate; and • test significant updates appropriately. No software environment can be guaranteed to be permanently free of vulnerabilities.

Where appropriate, production credentials and customer information should be separated from development and testing environments. Real customer documents should not be copied into development or testing systems without a legitimate reason and appropriate protections. Synthetic or test information should be used where reasonably practicable.

NeverExpiry may carry out security testing appropriate to the service and stage of development. Testing may include: • application checks; • access-control testing; • authentication testing; • database-permission testing; • storage-access testing; • dependency checks; • build checks; • deployment checks; and • other reasonable security validation. Security testing reduces risk but cannot guarantee that every vulnerability will be discovered.

Users should take additional precautions when accessing NeverExpiry through: • public computers; • shared household devices; • workplace devices; • borrowed devices; or • other devices not under their exclusive control. Users should: • sign out when finished; • avoid saving passwords on untrusted devices; • protect downloaded documents; • remove unnecessary local copies; and • avoid leaving sensitive information visible to another person.

Users should exercise appropriate care when accessing sensitive information through public, shared or untrusted networks. The security of the user's: • device; • operating system; • browser; • network; • email account; • local storage; and • other third-party applications is outside NeverExpiry's direct control.

Once a document is downloaded from NeverExpiry, the security of the downloaded copy also depends on the user's own: • device; • local storage; • cloud-sync services; • backups; • network; • sharing choices; and • security practices. NeverExpiry cannot control copies that users independently save, copy or distribute outside the service.

Email and ordinary messaging may not be appropriate for sending highly sensitive information. Users should not send: • passwords; • authentication codes; • full payment-card information; • card security codes; • secret credentials; or • unnecessary private documents through ordinary communications.

Users should be cautious about messages claiming to represent NeverExpiry. Before entering credentials, users should ensure they are using the genuine NeverExpiry website. NeverExpiry will not ask users through ordinary email to provide: • their existing password; • authentication codes; or • complete payment-card security information. Suspicious messages should not be trusted merely because they display NeverExpiry branding.

Security is a shared responsibility. Users are responsible for taking reasonable steps to protect: • their account; • passwords; • linked email account; • recovery information; • devices; • browser sessions; • downloaded documents; • local copies; • shared profiles; and • information they independently share outside NeverExpiry. Suspected compromise should be addressed promptly by resetting relevant credentials and taking appropriate protective steps.

Businesses and organisations using NeverExpiry remain responsible for controlling access within their own organisation. Where applicable, organisations should: • provide access only to authorised people; • remove access when no longer required; • protect employee credentials; • manage staff changes; • protect shared devices; • maintain appropriate endpoint security; and • report suspected compromise promptly. NeverExpiry's security controls do not replace an organisation's own security responsibilities.

NeverExpiry may be used to store sensitive documents such as: • passports; • identity documents; • visas; • driving documents; • insurance records; • financial information; • health information; • professional records; • licences; • background checks; • children's documents; • property records; and • business compliance information. Users should avoid storing information that is unnecessary for their intended use.

Where NeverExpiry allows information to be organised for: • family members; • children; • dependants; or • other profiles, the account owner or appropriate responsible person remains responsible for controlling access to those profiles. Users should ensure they have appropriate authority to manage information belonging to another person.

NeverExpiry may take reasonable protective action where there is evidence or reasonable suspicion of: • account compromise; • credential theft; • fraud; • malicious access; • security bypass attempts; • abusive automation; • harmful uploads; or • other serious misuse. Protective action may include restriction, suspension, session termination, credential reset or other proportionate measures.

Security researchers and users should act responsibly when investigating or reporting a suspected security issue. Do not: • access another user's private information; • download another person's documents; • alter or delete another person's information; • disrupt NeverExpiry availability; • conduct denial-of-service attacks; • deploy malware; • use social engineering; • exploit a suspected vulnerability beyond what is reasonably necessary to demonstrate it; or • publicly disclose an unresolved vulnerability in a way that unnecessarily increases risk. Reporting a suspected vulnerability does not authorise unlawful activity.

No website, cloud service, database, storage system, network, device or authentication system can guarantee complete protection against every possible threat. NeverExpiry therefore cannot guarantee that the service will be completely immune from: • cyberattack; • unknown vulnerabilities; • malicious activity; • human error; • infrastructure failure; • provider incidents; • credential theft; or • events outside reasonable control. NeverExpiry nevertheless aims to maintain safeguards appropriate to the risks associated with the service.

NeverExpiry will only make public security, accreditation, certification or technical-compliance claims that are accurate and can be supported.

Technology, security threats and NeverExpiry functionality change over time. NeverExpiry may therefore review and improve: • authentication; • access controls; • infrastructure; • storage arrangements; • monitoring; • service providers; • development processes; • backup arrangements; • incident response; and • other security safeguards. Security should not be treated as permanently complete.

NeverExpiry may update this Security information where: • security practices change; • infrastructure changes; • functionality changes; • service providers change; • risks change; • legal requirements change; or • improved safeguards are introduced. The latest revision date will be displayed at the top of this page.

English is the master Security text. The complete Security page is available in every language and regional language currently supported by NeverExpiry. When a user selects a language or regional language through the NeverExpiry language selector, the entire Security page will be translated and displayed in that selected language. This includes: • page title; • last-updated information; • sticky sidebar; • section headings; • paragraphs; • bullet points; • password-security information; • Forgot password information; • children and guardian information; • private-library information; • breach and incident information; • user-security information; • security-reporting information; • contact information; and • all other text belonging to this page. Translations must preserve the meaning and protections of the English master Security information.

For security questions, account-security concerns or to responsibly report a suspected NeverExpiry security issue, contact: enquiry@neverexpiry.com Please provide enough information for NeverExpiry to understand and investigate the issue. Do not send: • passwords; • authentication codes; • full payment-card numbers; • card security codes; • secret credentials; • another user's private information; or • unnecessary copies of sensitive documents.