FamilySearch Security & Compliance Policy
How Voice Ancestry protects FamilySearch credentials and meets the FamilySearch Compatibility Overview Minimum Capabilities for authentication and data security.
This security policy is documented, approved by Voice Ancestry management, and communicated to all team members. It is reviewed at least quarterly and whenever the FamilySearch integration is materially changed. The last review date is tracked alongside the integration build.
Questions or reports of a security issue should be raised through the in-app support channel or the contact options on the Terms of Service page.
Users link FamilySearch by being redirected to the official FamilySearch Third-Party User Authentication page (ident.familysearch.org) using the OAuth 2.0 authorization-code flow. Voice Ancestry never sees, collects, or stores FamilySearch usernames or passwords — the user authenticates directly with FamilySearch and only grants our app a scoped access token.
FamilySearch access tokens and refresh tokens are stored exclusively in a server-side, service-only data store that no app user can read, update, or delete. Tokens are never returned to the browser, never placed in cookies, and never embedded in client-side state. Every FamilySearch API call is proxied through a backend function that attaches the token server-side.
All traffic is encrypted end-to-end. The app is served exclusively over HTTPS, and every request to the FamilySearch API targets https://api.familysearch.org (or the sandbox equivalent). No FamilySearch request is ever made over plain HTTP.
Voice Ancestry registers as a confidential client. Short-lived access tokens are renewed automatically using a refresh token held only on the server, so users stay connected without re-authenticating while the token lifecycle remains controlled and revocable.
The authorization round-trip is bound by an HMAC-signed state parameter carrying the user id, environment, timestamp, and origin. The callback rejects any state that fails signature verification or is older than 10 minutes, preventing CSRF and authorization-code interception replay.
FamilySearch API Session IDs and the FamilySearch session cookie are never stored. No FamilySearch credentials are retained in any form. Users can disconnect at any time, which immediately deletes the stored token record and clears all connection metadata.
Because FamilySearch tokens are never delivered to the browser, no cookie carries the ability to use an access token. The application's own session cookie is served by the platform over HTTPS with the secure attribute, satisfying the secure-cookie requirement for any credential-bearing cookie.
FamilySearch Person ID (PID) numbers are stored on the user record to link app persons to FamilySearch tree persons, as permitted by the compatibility spec. All FamilySearch data is accessed under the FamilySearch API Terms of Use and clearly attributed to FamilySearch throughout the product.
Voice Ancestry is an independent product and a FamilySearch Innovation Partner applicant. FamilySearch® is a registered trademark of The Church of Jesus Christ of Latter-day Saints.