Trust and security at CoreParent

Records a court can check, not just believe

Every court-formatted export is a certified record: a unique verification code, a SHA-256 fingerprint of the exact file, and an Ed25519 digital signature, computed at generation and registered in our records registry. Anyone holding the document, a judge, opposing counsel, anyone at all, can confirm it at coreparent.app/verify or check the signature offline against our published key. A free business-records affidavit (Federal Rules of Evidence 902(11) and 902(13), 28 U.S.C. § 1746) is available for any certified export. The full story lives at /records and /how-it-works-in-court.

An evidentiary message record

The co-parent message thread is append-only: messages cannot be edited or deleted by either parent after sending, and each message carries server-recorded sent, delivered, and read times. When a co-parent communicates by email instead of the app, delivery is evidenced by the email provider's own delivery events. Notification history is kept in a hash-chained delivery log, so removals or alterations are detectable, and the log is explicit about what each channel does and does not prove. The same discipline extends to the rest of the record: journal entries and expenses carry an append-only, field-level edit history, expenses lock against content edits once your co-parent has seen or approved them, shared items void instead of deleting, and certified exports mark edited entries and fix the logged and last-edited times into each record's fingerprint.

Private by default, by architecture

Everything you put into CoreParent is yours alone. Sharing with your co-parent is per-item and explicit, enforced in the data model itself rather than by a settings toggle. Your co-parent sees nothing you have not deliberately chosen to share, and payments between parents flow directly through Stripe, so CoreParent never holds your funds or card details.

How your data is protected

Data is encrypted in transit (HTTPS/TLS) and at rest on our managed storage infrastructure. Uploaded documents are scanned on upload, stored under per-user paths, and served only through short-lived signed links. Sign-in is handled by Clerk, access is limited by role-based permissions, and sensitive document categories carry retention rules. If you delete your account, your personal data is purged, while certificates already issued to a court remain verifiable so a filed record never becomes uncheckable.

AI you can see through

Companion, our optional AI assistant, uses a single provider (Anthropic). Content sent to AI features is never used to train models and is deleted within 30 days under Anthropic's commercial terms, and we do not keep the text of your prompts or Companion's replies in our own logs. For message analysis, tone rewrites, incoming-message reframes, and deadline briefs, our servers replace your children's profile names with neutral placeholders before anything is sent, and restore them in what you see. You can turn Companion AI off entirely in Settings. The complete disclosure of what is sent, feature by feature, is at /your-data-and-ai.

What we will not claim

No co-parenting app is "court approved"; there is no court agency that certifies apps, and we will not pretend otherwise. Admissibility of any record is always the court's decision. And our certificate states its own limits on its face: it attests that a document is an unaltered CoreParent export generated at the stated time, not to the truth of user-entered content. We think saying exactly what our records prove, and no more, is itself a reason to trust them.

What is next

Trust work in progress, stated as roadmap and not as current fact: a zero-data-retention arrangement for AI processing (requested from our provider and pending), independent security testing with a published summary, and safety features for survivors developed with domestic-violence safety expertise. We will update this page as each lands.

Common questions