Last reviewed: 30 September 2026
Home Space holds information that matters: document expiry dates, addresses, family details and travel plans. This page explains, without jargon, how we protect it and how we check that the protection actually works. It only describes measures that are in place and have been tested.
Every piece of information is tied to your account. On every request the app checks that the data belongs to the person asking, and the database enforces the same rule a second time, on its own. A mistake in one layer is caught by the other.
How we tested it: we created two accounts and tried, from one, to read or change the other's information through every part of the app. None of the attempts succeeded. A release is also blocked automatically if any part of the app reads data without this check.
Extra documents you record for a family member, pet passport and chip numbers, insurance policy numbers, emergency contact phone numbers and email addresses, home addresses, personal notes and booking references are encrypted before they are stored. For passports, ID cards and driving licences Home Space keeps only the expiry date, never the document number, and it does not ask for health information at all. Anyone who got hold of a copy of the database would see scrambled text for these details, not the details themselves. The key that unlocks them is kept apart from the database.
How we tested it: we checked the live database and confirmed that every one of these fields is stored encrypted.
Your password is never stored, only a one-way fingerprint of it that cannot be turned back into the password. New accounts confirm their email address and are approved before they can be used. You can turn on two-step sign-in with an authenticator app; for administrators it is required. Resetting your password signs you out on every device.
How we tested it: after a few wrong passwords, further attempts are refused for a while, which stops automated guessing. We confirmed this on the live site.
Scans, photos and documents are kept in private storage that cannot be reached from the internet directly. When you open a file, the app creates a personal link that stops working after a few minutes. Only common document and image types up to 10 MB are accepted.
The connection to Home Space is always encrypted, and the site tells your browser never to fall back to an unencrypted connection. Other websites cannot show Home Space inside a hidden frame, and the page only runs code that comes from us — which blocks common attacks that try to slip foreign code into a page.
Some features use AI to read booking documents or to rephrase text. The AI never decides whether your trip is ready — fixed rules decide that. Whatever the AI returns is checked against a strict format before anything is saved.
Every change to Home Space is checked by more than 1,400 automated tests, including tests that sensitive details stay encrypted and that one account cannot reach another. The software building blocks Home Space relies on are checked automatically for known security problems.
In September 2026 we ran a structured security test covering account separation, shared links, signing in, file uploads, background tasks, AI input and attempts to inject code. Every issue it found was fixed and tested again.
From Settings you can download a copy of everything in your account, or delete the account yourself. Deleting permanently removes every uploaded file first and then every piece of information in the account; if removing the files fails, nothing is deleted and you can try again.
Encryption protects stored copies of your data; the service itself can read your information in order to show it to you and build your checklists. No system is perfectly secure, and we will not pretend otherwise. We review this page whenever something changes and at least every three months.
If you think you have found a security problem, please email info@colorcity.nl. Tell us what you found and how to reproduce it. Please do not access or change other people's information to prove it.