{
  "markdown": "# Legacy Shield\n\n> Secure digital vault for critical documents with emergency access. 100% European hosting.\n\n**Legacy Shield** is a privacy-first document vault designed for storing your most critical files—passports, wills, insurance policies, property deeds—with built-in emergency access for loved ones. Unlike general cloud storage, Legacy Shield uses client-side encryption and European-exclusive infrastructure to ensure maximum privacy and security.\n\n## 🌟 Key Features\n\n- **🔐 Zero-Knowledge Encryption**: Files encrypted in your browser before upload\n- **🚨 Emergency Access**: Loved ones can access your vault with unlock phrase (read-only)\n- **🇪🇺 European Data Sovereignty**: 100% EU infrastructure (hosted on Hetzner, Germany)\n- **📱 Document Viewer**: View PDFs, images, and documents in-browser\n- **🏷️ Smart Organization**: Categories, tags, favorites, expiration tracking\n- **✅ GDPR Native**: Privacy-first design, compliant by default\n- **🛡️ Powered by BitAtlas**: Uses the [BitAtlas](https://bitatlas.com) zero-knowledge encryption layer for all file storage and key management.\n\n## 🏗️ Architecture\n\n**Monorepo Structure:**\n```\nlegacy-shield/\n├── packages/\n│   ├── web/          # Next.js frontend (React + TypeScript)\n│   ├── api/          # Express backend (Node.js + TypeScript)\n│   └── shared/       # Shared types and utilities\n├── infrastructure/   # Deployment configs\n├── docker-compose.yml\n├── product-spec.md   # Product specification\n└── architecture-spec.md  # Technical architecture\n```\n\n**Tech Stack:**\n- **Frontend**: Next.js 14, TypeScript, TailwindCSS, Web Crypto API\n- **Backend**: Node.js, Express, Prisma ORM, PostgreSQL\n- **Storage**: Hetzner Object Storage (S3-compatible)\n- **Hosting**: Hetzner Cloud (Germany)\n- **Payments**: Stripe\n\n## 🚀 Quick Start\n\n### Prerequisites\n\n- Node.js 20+ and npm 10+\n- Docker and Docker Compose\n- Git\n\n### 1. Clone and Install\n\n```bash\ncd /Users/stephenballot/Documents/LegacyShield\nnpm install\n```\n\n### 2. Start Infrastructure\n\n```bash\n# Start PostgreSQL, Redis, and MinIO (local S3)\ndocker compose up -d\n\n# Verify services are running\ndocker ps\n```\n\n> **Note**: You can also use `npm run docker:dev` as a shortcut.\n\n### 3. Configure Environment\n\n```bash\n# Copy example environment file\ncp .env.example .env\n\n# Edit .env with your values (defaults work for local development)\n```\n\n### 4. Initialize Database\n\n```bash\ncd packages/api\n\n# Generate Prisma Client\nnpm run db:generate\n\n# Run database migrations\nDATABASE_URL=\"postgresql://legacyshield:devpassword@localhost:5432/legacyshield_dev\" npm run db:migrate\n\n# Optional: seed with test data\nnpm run db:seed\n\ncd ../..\n```\n\n> **Note**: The DATABASE_URL must be provided because Prisma doesn't automatically read the root `.env` file. See [GETTING_STARTED.md](./GETTING_STARTED.md) for details.\n\n### 5. Start Development Servers\n\n```bash\n# Start both frontend and backend\nnpm run dev\n\n# Or start individually:\nnpm run dev:web    # Frontend at http://localhost:3000\nnpm run dev:api    # Backend at http://localhost:4000\n```\n\n### 6. Access the Application\n\n- **Frontend**: http://localhost:3000\n- **API**: http://localhost:4000\n- **MinIO Console**: http://localhost:9001 (minioadmin / minioadmin)\n\n## 📚 Development\n\n### Available Scripts\n\n```bash\n# Development\nnpm run dev              # Start all services\nnpm run dev:web          # Start frontend only\nnpm run dev:api          # Start backend only\n\n# Building\nnpm run build            # Build all packages\nnpm run build:web        # Build frontend\nnpm run build:api        # Build backend\n\n# Testing\nnpm run test             # Run all tests\nnpm run lint             # Lint all packages\nnpm run type-check       # TypeScript type checking\n\n# Database\ncd packages/api\nnpm run db:migrate       # Run migrations\nnpm run db:seed          # Seed database\nnpm run db:studio        # Open Prisma Studio\nnpm run db:reset         # Reset database\n\n# Docker\ndocker compose up -d     # Start Docker services\ndocker compose down      # Stop Docker services\ndocker compose logs -f   # View Docker logs\n```\n\n> **Tip**: For detailed setup instructions, see [GETTING_STARTED.md](./GETTING_STARTED.md)\n\n### Project Structure\n\n```\npackages/\n├── web/                          # Frontend (Next.js)\n│   ├── src/\n│   │   ├── app/                  # Next.js App Router\n│   │   │   ├── (auth)/           # Auth pages (login, register)\n│   │   │   ├── (dashboard)/      # Protected dashboard pages\n│   │   │   └── emergency-access/ # Public emergency portal\n│   │   ├── components/           # React components\n│   │   ├── lib/\n│   │   │   ├── crypto/           # Client-side encryption\n│   │   │   ├── api/              # API client\n│   │   │   └── utils/            # Utilities\n│   │   ├── hooks/                # Custom React hooks\n│   │   ├── store/                # Zustand stores\n│   │   └── types/                # TypeScript types\n│   └── package.json\n│\n├── api/                          # Backend (Express)\n│   ├── src/\n│   │   ├── routes/               # API routes\n│   │   ├── middleware/           # Express middleware\n│   │   ├── services/             # Business logic\n│   │   ├── models/               # Data models\n│   │   ├── jobs/                 # Background jobs\n│   │   ├── utils/                # Utilities\n│   │   └── server.ts             # Main server file\n│   ├── prisma/\n│   │   ├── schema.prisma         # Database schema\n│   │   └── migrations/           # Database migrations\n│   └── package.json\n│\n└── shared/                       # Shared code\n    ├── src/\n    │   ├── types/                # Shared TypeScript types\n    │   ├── constants/            # Shared constants\n    │   └── utils/                # Shared utilities\n    └── package.json\n```\n\n## 🔒 Security\n\nLegacy Shield implements a **zero-knowledge architecture**:\n\n1. **Client-side encryption**: All files encrypted in browser before upload\n2. **Key derivation**: Master key derived from password using PBKDF2 (100k iterations)\n3. **Per-file keys**: Each file encrypted with unique AES-256-GCM key\n4. **Dual-key system**: Files encrypted with both owner key and emergency key\n5. **No plaintext storage**: Server never sees unencrypted files or keys\n6. **2FA mandatory**: Two-factor authentication required for all users\n\n### Encryption Flow\n\n```\nPassword → PBKDF2 → Master Key → Encrypts file keys → AES-256-GCM → Encrypted file\n                                                                           ↓\n                                                              Hetzner Object Storage (Germany)\n```\n\n## 🇪🇺 European Data Sovereignty\n\n**All infrastructure is hosted exclusively in the European Union:**\n\n- **Compute**: Hetzner Cloud (Falkenstein, Germany)\n- **Database**: Hetzner Managed PostgreSQL (Germany)\n- **Storage**: Hetzner Object Storage (Germany)\n- **Backups**: Automated backups to Nuremberg, Germany\n\n**Your data never leaves European soil and is protected by:**\n- GDPR (General Data Protection Regulation)\n- German BDSG (Federal Data Protection Act)\n- No US CLOUD Act jurisdiction\n\n## 📖 Documentation\n\n- **[Getting Started Guide](./GETTING_STARTED.md)**: Detailed setup instructions ⭐ Start here!\n- **[Product Specification](./product-spec.md)**: Complete product requirements\n- **[Architecture Specification](./architecture-spec.md)**: Technical architecture details\n- **[Infrastructure Guide](./infrastructure/README.md)**: Deployment information\n\n## 🧪 Testing\n\n```bash\n# Run all tests\nnpm run test\n\n# Run tests for specific package\nnpm run test --workspace=web\nnpm run test --workspace=api\n\n# Run tests in watch mode\nnpm run test:watch --workspace=web\n\n# Run e2e tests\nnpm run test:e2e\n```\n\n## 🚀 Deployment\n\n### Production Deployment (Hetzner Cloud)\n\n1. **Infrastructure Setup**: See [infrastructure/README.md](./infrastructure/README.md)\n2. **Environment Variables**: Configure production `.env` with real credentials\n3. **Database Migration**: Run migrations on production database\n4. **Deploy**: Use GitHub Actions or manual deployment\n\n```bash\n# Build for production\nnpm run build\n\n# Deploy to Hetzner (manual)\n# See infrastructure/deploy.sh\n```\n\n### CI/CD\n\nGitHub Actions workflow automatically:\n- Runs tests on every PR\n- Builds and deploys to staging on `develop` branch\n- Builds and deploys to production on `main` branch\n\n## 🤝 Contributing\n\nThis is a private project. For the development team:\n\n1. Create feature branch: `git checkout -b feature/your-feature`\n2. Make changes and commit: `git commit -m \"Add your feature\"`\n3. Push branch: `git push origin feature/your-feature`\n4. Create Pull Request on GitHub\n\n### Code Standards\n\n- **TypeScript**: Strict mode enabled\n- **Linting**: ESLint with Airbnb config\n- **Formatting**: Prettier (automatic on commit)\n- **Commits**: Conventional commits format\n\n## 📊 Pricing\n\n- **Free Tier**: 15 documents, 1 emergency contact\n- **Pro Tier**: $10/month or $500 lifetime\n  - 100 documents\n  - 5 emergency contacts\n  - Advanced features (expiration tracking, sharing, audit logs)\n\n## 📄 License\n\nCopyright © 2026 Legacy Shield. All rights reserved.\n\nThis is proprietary software. Unauthorized copying or distribution is prohibited.\n\n## 🆘 Support\n\n- **Documentation**: See spec files in root directory\n- **Issues**: GitHub Issues (private repo)\n- **Email**: support@legacyshield.com\n\n---\n\nBuilt with ❤️ in Europe. Your data, your privacy, your legacy.\n",
  "bytes": 9374,
  "sha": "68ab68d5398434a50f08d72b23be2471f9fb118f30c518650ffd3e450f647b02",
  "repo_slug": "stephenballot-ai/legacy-shield",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_stephenballot_ai_legacy_shield_1550c0e6/readme"
}