Yes. Every database table enforces row-level security, so no family can ever access another family’s data. Documents are stored privately and served only via short-lived signed URLs.