Passwords
Not your email's, not your bank's, not your online store's. Not one. Not even “just in case.”
Security and privacy
Tesora is the map,
not the safe.
Here it all is, plain: what we ask you for, what we will never ask you for, where each thing lives, and what happens the day you want to leave. If something doesn't exist yet, you'll read that here too.
- Zero passwords, ever
- Your files, in your Drive
- Your Asset File, downloaded
What Tesora will never ask you for
This isn't a marketing promise. It's how the thing is built: the fields don't exist, so there's nothing to capture and nothing to steal.
PINs and bank codes
No card PIN, no bank e-signature, no full account numbers.
Tokens or access to your accounts
Tesora doesn't connect to your bank, doesn't connect to your email, and asks for no permission to get into anything of yours.
Recovery phrases
For a crypto wallet we record that it exists and where you keep the physical backup. Never the backup itself.
Tesora records that something exists and where it is. Never how to get in.
That's a design decision, not a limitation: a treasure map is not the key to the chest. If someone walked off with your entire inventory, they couldn't move a single peso of yours — because there's nothing in there to do it with.
The whole metaphor
A treasure nobody can find is a buried treasure. Tesora is the map.
The key to the map
You and your notary office hold it. The notary office comes in as a reader: it sees what exists and where it is, so it can issue a notarial certification of facts and so nobody starts from zero the day it's needed.
It only reads. You decide: you grant the access, and you take it away whenever you want.
The keys to the treasure
The passwords, the PINs, the e.firma, your wallet phrase. They stay yours alone. They never go on the map, the notary office doesn't see them, and Tesora doesn't see them.
Nobody can hand over what they never had.
The map, yes. The keys stay with you.
Five facts get recorded for each thing
What it is · where it is · what it's worth, by your own estimate · who knows today that it exists · who should receive it. And whatever you don't know yet gets flagged as pending, in plain sight.
Every kind of asset, same rule
- House, land, or other real property
- Cars or other vehicles
- Accounts, investments, or Afore
- Contracted protection
- A company, or a share of one
- Collections and valuables: art, jewelry, watches, records, prints
- Furniture and equipment worth something
- Digital things: email accounts, files, photos
- Brands, patents, and rights: trademarks, patents, copyrights, licenses, royalties
- Domains and online store
- Cryptocurrency
This is how an e.firma looks in your inventory: that it exists, and whether someone else knows where you keep it or whether only you do. No credentials.
This is how a crypto wallet looks: that it exists, what you call it, roughly what it's worth, and whether anyone else knows where its papers are. No seed phrase, no keys.
You write. Tesora structures. Your Drive stores.
That's the whole chain. There is no fourth link where your inventory lives with us.
You write
You answer block by block, in whatever order you want. “I don't know” is a valid answer: it becomes a concrete pending item, not an invented fact.
Tesora structures
It sorts what you entered into blocks, builds your Asset File, and names the folders so someone else can understand them without you.
Your Drive stores
The files stay in folders inside your own Google Drive, under your account. Not on Tesora servers.
What gets stored and where, exactly
Three places, and not one of the three is a server of ours with your assets inside it.
| What | Where it lives | Who sees it and who deletes it |
|---|---|---|
| Your diagnostic answers | This device's browser | It's calculated right here. No server, no account, no list. Clear the site data and nothing is left. |
| Your progress in the guided inventory | Your device's browser, only if you allow it | You, with the “Borrar todo” (Delete everything) button. That saved copy isn't needed for the service to work, and Tesora can't read it, recover it, or back it up. |
| Your Asset File | The PDF you download, on your own computer | You, and whoever you hand it to. It's generated in your browser. |
| Your files and folders (the vault) | Folders in your Google Drive, under your account | You, and whoever you invite. Your notary office comes in as a reader, if you ask it to. |
| Passwords, PINs, codes, tokens | Nowhere | They aren't asked for, aren't captured, and don't exist in the system. |
| Documents you choose to have AI read (optional) | Transmitted to be read; Tesora does not store them | The provider keeps them for up to 30 days and then deletes them. The full detail is below. |
| Site measurement | Anonymous technical events | Which sections get viewed and whether someone completed the diagnostic. Never your answers, your name, or your data. |
The diagnostic asks for no email, no phone, no sign-up. If at some point you decide to write to the assistant in your own words, those sentences do travel — and nothing travels until you hit send.
Full honesty
Having AI read your documents is optional
You won't read here that “nothing ever leaves your device.” If you choose to let the AI read a document, that document leaves. We tell you where it goes, what gets pulled out of it, and how long it lasts.
You can always type it in yourself
- You don't have to use it: you can write every field yourself, and the result is identical.
- Not using it takes away access to nothing in the service.
- We ask your permission before every single send, and you can withdraw it whenever you want.
If you do use it, this is what happens
- The image is transmitted to Anthropic PBC (United States), which returns only the fields it read.
- Tesora does not store the image: it's transmitted, read, and discarded.
- The provider keeps it for up to 30 days, solely for abuse and security monitoring, and then deletes it.
- Your data is not used to train artificial intelligence models.
What gets extracted
Only what the notarial process needs: name, date of birth, address, CURP, expiration date, place of birth, parents' names, marital property regime, and spouse's name.
What is neither extracted nor kept
Voter key, electoral section, CIC/OCR, your signature, your fingerprint, and your photo. None of that is read and none of it is stored.
Conversations with the Arquitecto (the Architect) run under the same rules: a maximum of 30 calendar days of retention by the provider, and zero model training. The Arquitecto rides along with you inside the guided inventory: it doesn't decide for you and it fills in nothing without your approval.
And if Tesora stops existing?
That's the right question. And the answer doesn't rest on our good intentions: it rests on where we put your things from day one.
- Your Asset File is already downloaded on your computer. You don't have to ask for it.
- Your files live in your Google Drive, under your account, not ours.
- The format is PDF and ordinary folders. You don't need Tesora to read them.
- Your notary office's read access is something you granted from your own Drive. Taking it away is still yours to do.
Tesora organizes. It doesn't hold anything hostage.
What your notary office sees — and what it can't do
The vault lives in your account. The notary office comes in as an invited reader, the same way you invite someone into a shared folder. You invite it in. You take it out.
What it can do
- Read your inventory: what exists and where it is.
- Receive the package you prepare for your appointment, so the appointment is worth the trip.
- Call you to confirm when there's a relevant change, the way your bank does on a large transfer.
What it can't do
- Edit, add, or delete anything in your inventory. It reads, it never writes.
- See or ask you for a password, a PIN, or a code. They don't exist in the system.
- Open your Love Letter. It certifies that it exists and when you deposited it; the content goes to your family.
- Charge you through Tesora. You pay its fees and duties directly to the notary office, depending on the act.
You pick the notary office. None is assigned to you, none holds exclusive territory. If you already have one you trust, that one is yours.
The read access is while you're alive. That's the design, and that's how it's being drafted with a notary office: the exact form of the instrument gets validated with a lawyer and a notary before it becomes a commercial promise.
What your support network sees
Your network is the people who should find the map: whoever is going to execute, and whoever needs to hear about it. You decide who's in and what each one sees.
- You build the list. On the Fundación plan you record whoever executes plus two contacts; on Patrimonial you define a circle with permissions block by block.
- Each one sees only their part. What you marked for that person, nothing more. Nobody sees the whole inventory just for being on the list.
- Nobody gets keys. Not your network, not your notary office, not Tesora. They get the map: what exists and where it is.
- Tell them. Naming someone who doesn't know is the same as naming nobody. In the guided inventory it stays pending until that person knows.
Today the network is recorded inside your inventory and you control what each person sees. The portal where your executor logs in on their own does not exist yet: it's under Coming soon, and that's how it appears in the feature status.
Your personal data, under Mexican law
Tesora operates under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and its Guidelines.
Who is responsible for your data
Daniel Cardona Sánchez, an individual engaged in business activity.
Blvd. López Mateos 3261, Int. 118, Col. El Rosario, C.P. 37125, León de los Aldama, Guanajuato.
Contact: contacto@tesora.mx
Your ARCO rights
Access, rectification, cancellation, and objection. You request them at contacto@tesora.mx, the answer arrives within a maximum of 20 business days, and the process is free.
- No tracking cookies, no advertising, no third-party trackers. Site measurement is anonymous and includes neither your answers nor your identity.
- Nothing is transferred to a notary office automatically. It only happens when you ask for it or authorize it, and from that point the notary office answers for that data independently.
- Providers involved: Vercel Inc. (site hosting) and Anthropic PBC (assistant and optional document reading), both in the United States.
- Security measures: encrypted communications, access controls, and documented audits.
What already works and what doesn't yet
A trust page that only shows the good parts is not a trust page. This is the real status of each piece, today.
| Piece | Status | What it means |
|---|---|---|
| Zero passwords, PINs, and codes | Available | It's how the guided inventory is built. The fields don't exist. |
| Manual entry, no AI | Available | A complete alternative to document reading. Same result. |
| PDF Asset File and vault in your Drive | Available | You download it yourself and the folders stay in your account. |
| Recording your support network | Available | It's recorded in your inventory. The executor's own portal, not yet. |
| Certification of participating notary offices | In progress | The program is open and no notary office has completed it yet. That's why you won't read here that your inventory has already been certified by a notary office: it can't be true yet. |
| Notarial certification that the inventory and the Love Letter exist | Under review | The exact scope is being defined with a notary office before we promise it. |
| The inventory as a living annex to the will | Under review | It's the design we're after, not a done deal. It depends on how the clauses are drafted, and the notary is the one who confirms that. |
| NOM-151 preservation certificate | Coming soon | Planned with an accredited third party. Today it isn't implemented. |
| Executor portal and online payment | Coming soon | They don't exist yet. Activation happens over WhatsApp today. |
Every statement with legal effect is validated with a lawyer and a notary before it becomes a commercial promise. Until it's validated, it's presented as design, and that's how it appears in the feature status.
Start by knowing what you're missing.
Three minutes. Six questions. Without handing over a single personal detail — and without a single password.
6 questions · 3 minutes · no sign-up