HeirVault

For people who carry real risk

If you cannot check in, the right people still know what to do.

Leave contingency handoffs for named editors, counsel, colleagues, or family. Keep checking in so nothing opens. If check-ins stop past the waiting period, only the contacts you name can claim.

Contingency vault

Encrypted until release rules fire

Live check-in

Editor handoff

Encrypted · named beneficiary

Counsel note

Encrypted · named beneficiary

Trusted contact

Claim held until waiting period ends

Status

Handoffs encrypted

Encrypted on your device

Held

EncryptedCheck-inWaiting

This is for you if

Your work means silence is not ordinary

Journalists. Government and civil service. Advocates. Investigators. Anyone who needs beneficiaries to get encrypted instructions if they cannot check in.

  • Journalists and investigators
  • Government and civil service
  • Advocates and human-rights workers
  • Other high-risk professionals

The path

Leave it. Check in. Wait. Claim.

Same vault mechanics. Click a step anytime.

End-to-end encrypted

End-to-end encrypted

Docs, logins, bank details, and files encrypt before upload.

Joint checking

Bank account · for Esme

Encrypted
BankFirst National
Account•••• 4821
Routing•••• 0912
Encrypted in browser
Login
Wallet
Doc
Keys on device

Keys stay with you

Encrypted data only

Nothing readable

Beneficiaries claim only what you designated. Nothing becomes public by default.

Why they can trust it

Protected by end-to-end encryption

Your live vault encrypts in your browser before upload. That means HeirVault stores ciphertext and timing state, and cannot decrypt your live vault. That removes vendor plaintext as one risk.

  • Leave handoffs on your device; end-to-end encryption before upload
  • Keys stay with you. Email codes never unlock the vault.
  • Each beneficiary receives only their handoff

Shield when cadence is tight

Field check-ins without the web app

Same leave-and-claim path as Free and Pro. Choose Shield only if you need shorter intervals, device API keys, or a priority claim email queue.

Device check-in API

Script or device keys so check-ins happen without opening the web app.

Short intervals

From 1 day, with a waiting period you set between 3 and 14 days.

Priority claim email queue

When release starts, claim and reminder emails drain ahead of the standard queue. Reminder emails (pre-due, mid waiting period, countdown) ship on every plan.

Honest limits

What this does not promise

Timed release is powerful. It is not a full threat model.

Coercion while you can still act
Shield includes a duress passphrase: a second passphrase for when you are forced to unlock. It opens a decoy vault and alerts a trusted contact. It cannot help if your real passphrase was already captured, and it is not a fake identity. What a duress passphrase is
Unlocked session on a seized device
Keys in memory on an unlocked device can be at risk. Lock the vault and keep idle lock on.
Account and timing metadata
HeirVault can see account email, billing, and release timing. Your live vault is end-to-end encrypted, so we cannot decrypt those contents.
Legal process over accounts
We may be compelled to produce account records and ciphertext. End-to-end encryption still means we cannot decrypt your live vault without your keys.
Anonymity and field OPSEC
HeirVault is not Tor-grade anonymity tooling, a newsroom CMS, or a substitute for your source practices.
Why a check-in was missed
We do not investigate cause. Timing rules fire the same way either way.

Go deeper

Same vault. Different entry points.

  • Journalists

    Contingency handoffs for an editor or counsel if you cannot check in.

    Journalist page
  • Families

    Store will copies, policies, and notes. We do not draft wills.

    Families page
  • Crypto holders

    Seed phrases and wallet instructions as encrypted docs, with honest OPSEC.

    Crypto page
  • Founders

    Continuity docs for co-founders, counsel, and operators.

    Founders page
  • Security model

    What we can see, what we cannot, and how release timing works.

    Read security

Questions careful people ask

Yes. Miss check-ins, pass the waiting period, then beneficiaries can claim what you designated. HeirVault is a dead man's switch for docs, passwords, and files with a claim portal, not a single blast email timer.

People whose work or role creates personal risk if they go silent: journalists, government and civil servants, investigators, advocates, and others who need contingency handoffs for named editors, counsel, colleagues, or family.

Editors, lawyers, trusted colleagues, partners, family, or anyone you trust with a specific encrypted handoff. Release goes to beneficiaries you name, not to the open internet.

Free and Pro allow 7 to 365 days. Shield allows intervals from 1 day and waiting period between 3 and 14 days.

Witnesses confirm before beneficiaries get access. They do not stop coerced check-ins. For device-level coercion, Shield adds a duress passphrase with a decoy vault and silent alert.

No. Your live vault is protected by end-to-end, zero-knowledge encryption. Contents encrypt in your browser before upload, so HeirVault cannot decrypt your live vault. Assisted delivery stores a handoff key only for that beneficiary's handoff and is not end-to-end to the beneficiary alone.

Leave the path while you still control the device

Start free with the same leave-and-claim path as Pro and Shield. Choose Shield when you need device check-ins and tighter intervals.