We can’t read your will, and neither can anyone else until it’s time.
Here is how that works, in plain English, and how your family can be sure that what they receive is exactly what you left.
Locked before it leaves your device
When you deposit your will, it is locked on your own computer or phone, using a passphrase only you know. What reaches us is a scrambled file. We never see your passphrase, and we never see your will in a form anyone could read.
Our staff can see the basics of your account, such as your name, your email address and the date you deposited. They cannot open your documents.
How your family can open it when you can’t
A will that only you could unlock would be no use to your family. So when you deposit, your device also seals a second copy of the key, in a way that only the release step can open.
The release key that opens it is held on our side and plays no part in the day-to-day running of the service. It is used only once the whole process described in How it works has run to the end, and before it is used the system checks the record to confirm that every stage really happened.
We would rather tell you this plainly than hide it. It is the one deliberate exception to “only you hold the key”, and it exists so that your family is never locked out.
A receipt for exactly what you deposited
At the moment you deposit, your device works out a fingerprint of your document: a short code that would come out differently if even a comma were changed. We sign a receipt recording that fingerprint and the date.
Your nominees receive the same receipt alongside the will, so they can be certain the document in front of them is the one you deposited, on the day you deposited it.
A record that cannot be quietly rewritten
Every step is written down as it happens: each check-in, each reminder, what your verifier said, and the release itself. Each entry is sealed to the one before it, like links in a chain. If anyone altered or removed an entry, the chain would no longer fit together, and it would show.
The system checks this record before any release, and your family can read it in full.
Making sure it is really you
- Signing in. There is no ordinary password to guess or steal. You sign in with a passkey (your fingerprint, face or device PIN) or a code from an authenticator app, and we email you whenever a new device signs in.
- Your declaration. Before your first deposit you confirm that you are the person named in the will and that you are depositing it of your own free will. That statement is recorded with the date and shown to your nominees at release.
- Check-in links. Each link works once and needs a real person to press a button. An old forwarded email, or an email program that opens links automatically, cannot check in on your behalf.
- Your nominees and verifier. Each of them has their own private link and confirms with a one-time code before they can see or do anything.
What we cannot do for you
Because we cannot read your will, we also cannot reset your passphrase. When you set up your vault you are given a 24-word recovery code. Keep it somewhere safe: it is the only way back in if you forget your passphrase. More on this in the questions and answers.