What we can read, and what we can't.

A dead man's switch is only worth using if the people running it cannot open the vault themselves. This page states plainly where the boundary sits.

AES-256-GCM · ZERO-KNOWLEDGE · REVIEWED 2026-08-03

The short version

Vault contents are encrypted on your device with a key derived from your passphrase. We store ciphertext. We cannot read your letters, your documents or your passwords, and no support process, court order or internal tool changes that — because the key is not something we hold.

Everything else — your email address, your guardians' contact details, your check-in timestamps — isreadable by us. It has to be: the system sends mail and places calls on your behalf. We would rather be precise about that than claim a blanket "end-to-end encrypted" that isn't true.

threat-modelWHAT EACH LAYER DEFENDS

Vault contents

Client-side encrypted, zero-knowledge

AES-256-GCM with a key derived from your passphrase via Argon2id. Encrypted before it leaves your device. Unreadable by us, by our hosting provider, and by anyone who obtains a copy of the database.

ZERO-KNOWLEDGE

Recipient keys

Wrapped per recipient

Each vault item is sealed to the recipients you assign. Their access key is wrapped separately and only unwrapped when the release conditions are met.

ZERO-KNOWLEDGE

Account data

Encrypted at rest, readable by us

Email, phone, guardian contact details and check-in history. Encrypted on disk and in transit, but we hold those keys — the system cannot send an SMS to a number it cannot read.

SERVICE-READABLE

Billing

Held by our payment processor

Card details never touch our servers. We store a customer reference and a plan, nothing more.

PROCESSOR-HELD

If you lose your passphrase

Your vault is unrecoverable. There is no reset link, no support override and no backdoor, because any mechanism that could return your data to you could return it to someone impersonating you.

At setup you are given a recovery code and required to confirm you have stored it somewhere outside the app. That code is the only route back in. The rest of your account — guardians, schedule, billing — survives a lost passphrase; only sealed vault items are lost.

Failure modes we design against

A false positive. The expensive failure is not a missed alert, it is an alert that goes out when you are fine. Three self-contact rungs precede any third party, and one tap resets everything.
An early release. The seven-day vault delay is enforced server-side and cannot be shortened by any account setting, any guardian action, or any support request.
A compromised guardian account. Guardians cannot trigger escalation, cannot see vault contents before release, and cannot alter your schedule. The worst a compromised guardian account yields is the knowledge that you use the service.
Us disappearing. You can export your entire vault, in the clear, at any time. If the company ceased trading you would get notice and an export window, and the export format is documented so it is readable without our software.

Reporting a vulnerability

Mail security@lifevault.example. We aim to acknowledge within one working day and to agree a disclosure timeline with you. We do not pursue researchers acting in good faith, and we will credit you in the changelog unless you would rather we didn't.

Please do not test against other people's accounts. If you need a second account to demonstrate an issue, ask and we will provision one.