Security
Security at Wardline
Wardline builds software for shared decisions: records that several people rely on, where it matters who agreed to what and when. This page explains what all our products have in common, then how each one protects the people who use it.
Across all our products
Our approach
We build Wardline to be checked, not just trusted. Three ideas run through everything: give each person only the access they need, keep sensitive content out of places it doesn't need to be, and make the records prove their own integrity.
Records that show any change
Every action is added to a permanent, append-only history. Each entry is mathematically linked to the one before it, so changing or deleting anything after the fact breaks the chain and is detectable. A copy is kept in write-once storage that can't be edited, even by us.
Encrypted throughout
All data is encrypted in transit and at rest. Where our products hold family information, it's also encrypted with a key that belongs to that family or case alone. When the family or case is closed and the key is destroyed, the content becomes permanently unreadable, including to us.
Each product stands alone
Each product runs on its own infrastructure, with its own keys and its own records. A problem in one can't reach the others.
Wardline Co-Parent
In the co-parenting app, each family is its own space, and the parents are the members with full authority.
Each family's space is separate
The separation is enforced by the database itself, not just by our application code, so a bug in one part of the app can't expose another family's records.
Both parents are equal
Promoting someone to parent, removing a parent, bringing in a shared mediator or parenting coordinator, and closing the family's account all need every parent's agreement.
No standing access for Wardline staff
Our team can't browse your records. In the rare case that someone needs to see real data to resolve a problem:
- a named person must request access to one specific item, for a stated reason and a limited time;
- every parent must approve;
- any parent with full say can decline, or end approved access early;
- every request is recorded permanently in your family's own history, even one that's denied.
Support staff can't search for accounts. To get help, you create a short-lived code in the app and give it to the support agent.
Your children's details stay with your family
Children's names, dates of birth, school and medical details are held only inside your family's encrypted space. Wardline keeps no central list of children.
Professionals only see what you allow
A shared professional can't read the family's messages unless every parent agrees to it.
AI and your messages
Every message is checked by an automated safety screen before it's sent, using an AI service in the same cloud platform we use. A message with a threat or controlling language isn't sent. If a message sounds like you're going through a really hard time, it isn't sent either: only you see it, with places to get support. The tone check is separate and optional: it suggests gentler wording, and you can always send your own. Your messages are never used to train AI models.
A record you can take to court
You can export your family's tamper-evident record yourself, at any time, for free, without contacting support.
Built to NNEDV's safety checklist
See how Co-Parent covers NNEDV's co-parenting app safety checklist, item by item.
Wardline Accord
Accord holds some of the most sensitive material in a family-law case: children's details, health provisions and attorney–client communication.
A key for every case
Each case's content is encrypted with its own key. Deleting a case destroys that key, so its content becomes unreadable everywhere, including in backups.
No support access without the parents
Wardline support can't search for cases. Support can only see a case when a parent gives them a short-lived code and every parent who has joined approves. Access is read-only, limited in time (never more than 72 hours), never includes private attorney–client comments, and every look is shown to the whole team.
Everyone sees only what they should
Each person on a case has a role. Each attorney has a private channel with their own client, and a party's private material stays private.
Records that can't be quietly altered
Every stored record is signed with a separate key, so a record changed outside Accord is detected and refused.
Closed cases don't linger
A closed case is deleted 80 days after it closes. Everyone on it gets at least 14 days' notice and a link to download a copy first.
Sign-in
Professionals sign in with passkeys. Parties join with a personal invite link and a one-time code sent to their email; each link is tied to one case and one person.
No AI
Accord doesn't use AI on case material, and it never suggests what anyone should decide.
Approvals you can prove
Each approval is tied to a fingerprint of the exact version approved. The permanent record of who approved what holds only those fingerprints and who did what, never case content, so it can still prove what was agreed after a case has been deleted.
Agreements with Wardline
When Wardline signs an agreement with you, such as a non-disclosure agreement, it uses Wardline Sign, our own signing tool. Signing needs a personal link and a code sent to your email, every step is kept in write-once storage, and the record is timestamped by two independent services so you can check it yourself. See how to check a signed agreement.
Independent review
We plan to have our controls audited independently and to publish summaries of penetration test results.
Reporting a vulnerability
If you find a security issue, email security@getwardline.com. We welcome responsible disclosure and will respond quickly.