HeirVault

HeirVault

For journalists

Contingency handoffs, held until check-ins stop.

Leave editor instructions and counsel notes now. Beneficiaries get access only after missed check-ins and the waiting period. Your live vault is protected by end-to-end, zero-knowledge encryption.

Timed disclosure

Encrypted until release rules fire

Live check-in

Editor handoff

Opens only if you go silent

Source protection note

End-to-end encrypted

Counsel instructions

Who moves first, and how

Check-in on schedule

Everything stays sealed

What this is not

HeirVault is not a newsroom CMS, not anonymity tooling, and not a substitute for operational security. It is a dead man's switch with check-in timed release to contacts you name.

The path

Four steps, start to claim

  1. 01

    Leave

    Stage the editor handoff and counsel notes now, while things are calm.

  2. 02

    Check in

    Keep your cadence from anywhere. Shield supports device check-ins over the API.

  3. 03

    Waiting period

    Silence starts a buffer. Witnesses can confirm before anything opens.

  4. 04

    They claim

    Only the editor, counsel, or contact you named can claim their handoff.

What people leave

Handoffs that stay unread until release rules fire

Editor contingency handoff
Context an editor needs if you become unreachable.
Counsel handoff
Encrypted directives for counsel, separate from day-to-day email.
Device and account instructions
Practical steps for a trusted person: what exists, what to preserve.
Source-context notes you choose to stage
Only what you intentionally designate, unlocked with the beneficiary passphrase for your chosen unlock mode.

Witnesses on Pro and Shield

A second confirmation path, not magic safety

Witnesses can confirm release before beneficiaries get access. That adds human judgment after the waiting period. Shield also adds a duress passphrase with a decoy vault for device-level coercion.

Start here

Three files to stage first

  • An editor handoff

    What to verify, what to publish, and in what order.

  • A source protection note

    How to protect the people who trusted you, staged deliberately.

  • Counsel instructions

    Legal first moves, before anything becomes public.

Honest limits

What this does not promise

Timed release is powerful. It is not a full threat model.

Coercion while you can still act
Shield includes a duress passphrase: a second passphrase for when you are forced to unlock. It opens a decoy vault and alerts a trusted contact. It cannot help if your real passphrase was already captured, and it is not a fake identity. What a duress passphrase is
Unlocked session on a seized device
Keys in memory on an unlocked device can be at risk. Lock the vault and keep idle lock on.
Account and timing metadata
HeirVault can see account email, billing, and release timing. Your live vault is end-to-end encrypted, so we cannot decrypt those contents.
Legal process over accounts
We may be compelled to produce account records and ciphertext. End-to-end encryption still means we cannot decrypt your live vault without your keys.
Anonymity and field OPSEC
HeirVault is not Tor-grade anonymity tooling, a newsroom CMS, or a substitute for your source practices.
Why a check-in was missed
We do not investigate cause. Timing rules fire the same way either way.

Shared with the high-risk hub. Full model on Security.

Questions careful people ask

Yes. Miss check-ins, pass the waiting period, then beneficiaries can claim what you designated. HeirVault is a dead man's switch for docs, passwords, and files with a claim portal, not a single blast email timer.

People whose work or role creates personal risk if they go silent: journalists, government and civil servants, investigators, advocates, and others who need contingency handoffs for named editors, counsel, colleagues, or family.

Editors, lawyers, trusted colleagues, partners, family, or anyone you trust with a specific encrypted handoff. Release goes to beneficiaries you name, not to the open internet.

Free and Pro allow 7 to 365 days. Shield allows intervals from 1 day and waiting period between 3 and 14 days.

Witnesses confirm before beneficiaries get access. They do not stop coerced check-ins. For device-level coercion, Shield adds a duress passphrase with a decoy vault and silent alert.

No. Your live vault is protected by end-to-end, zero-knowledge encryption. Contents encrypt in your browser before upload, so HeirVault cannot decrypt your live vault. Assisted delivery stores a handoff key only for that beneficiary's handoff and is not end-to-end to the beneficiary alone.

Leave the handoff. Keep checking in.

Use the high-risk hub for shared limits and FAQs. Choose Shield when you need device check-ins and shorter intervals.