How WholeFamily encrypts your family's photos

Published October 18, 2026

Every photo and video you add to WholeFamily is encrypted, or locked, by our app before we store it. Each one gets its own key, each album has a key that locks those keys, and the album keys are protected by Amazon's key system. Someone who gets hold of a stored file cannot read it, and the keys are kept somewhere else. This post explains how that works, in plain words.

What "encrypted" usually means

Almost every photo service says your photos are encrypted. Usually that means the hard drives in the data center are encrypted, so a thief who carries a drive out the door gets nothing.

That is worth having, but it is not how photos usually leak. They leak when a storage account is left open by mistake, or when a password or access key is stolen. In those cases drive encryption does not help, because the service unlocks the photo automatically for anyone who looks like the service.

What we do instead

Our app locks each photo itself, before it is stored:

1. Each photo gets its own key. Every photo and video is locked with its own random key.
2. Each album has a key that locks the photo keys. The key for every photo in an album is itself locked with that album's key.
3. Album keys are protected by Amazon's key system. It keeps the top-level key inside dedicated security hardware, and it will only unlock an album's key for a request about that same album.

The pieces are kept apart on purpose. Our photo storage holds locked files and no keys. Our database holds keys, but only locked ones. So a leak of our storage, or of our database, on its own gives nobody a readable photo.

We lock the smaller versions the app uses too, such as thumbnails and video preview frames, not just the original. Profile photos, family photos and album covers are locked the same way. And every file carries a safety check: if it has been tampered with or damaged, the app will not show it.

When photos are unlocked

Our servers unlock a photo when they show it to someone in your family, and when they make the smaller versions. That is what lets grandparents see photos in an email or a web browser, lets you get everything back after losing a phone, and lets us build an export when you ask for one. Very few people can change the code that does this, and every change is reviewed. Once a photo is on someone's phone, as a screenshot or a saved copy, it is outside anything we can protect.

The photo itself only reaches the app through a link that expires, and location details are removed when you upload. How WholeFamily protects your family's photos covers those and every other protection.

For the technically minded

• Each object, including every rendition and video poster, is encrypted with AES-256-GCM under its own random data key. GCM's authentication tag makes any tampering fail closed.
• Data keys are wrapped under a per-album key. Album keys are generated in AWS Key Management Service, stored only wrapped, and unwrapped only with that album's encryption context.
• Media is served through URLs signed with a per-album key over the object and an expiry. The serving route verifies the signature, and live media is sent with Cache-Control: private.
• Our servers reach the key service with short-lived credentials issued per deployment. There are no long-lived cloud access keys in our code or configuration.

What happens when you add a photo:

What happens when you open the app and view a photo:

The short version

• Every photo and video is locked before it is stored, each with its own key.
• Each album's key locks its photos' keys, and Amazon's key system protects the album keys.
• Storage and keys are kept apart, so a leak of either one alone gives nobody a readable photo.
• Our servers unlock photos to show them to your family, which is what makes email, browser viewing and recovery work.

Read every way we protect your family's photos, or the privacy policy.