The family’s record, by invitation.

Each family’s ledger opens only to the people it names.

• Multi-factor sign-in. Principals confirm with an authenticator code.
• Sessions close in eight hours. Access that is withdrawn stops on the next request.
• Walled off by the database. One family can never read another's rows.
• Two people on every approval. The database refuses an approval by whoever made the entry.