Guardians
Trusted contacts who hold encrypted key fragments for vault recovery and release authorization.
Guardians
Your vault key is the single artifact that can decrypt your files. Storing it in one place means a single point of failure. Inheribase splits your key across multiple trusted contacts—your Guardians—using Shamir's Secret Sharing (SSS).
Guardians never see your data. They hold a mathematical fragment (share) that is useless on its own. Delivery is only possible when the required threshold of guardians cooperate.
How the Threshold Works
A secret is split into multiple shares with a critical property: Any single share reveals zero information about the original key.
Inheribase offers two security presets:
| Preset | Guardians | Threshold | Recommended For |
|---|---|---|---|
| Standard (2-of-3) | 3 guardians | Any 2 must cooperate | Most users |
| Enhanced (3-of-5) | 5 guardians | Any 3 must cooperate | High-value estates |
If one guardian becomes unreachable (lost email, relocated, deceased), the remaining guardians can still reconstruct the key. The threshold ensures resilience without sacrificing security.
The Guardian's Role
Guardians are not technical operators. They need nothing more than a valid email address and a web browser. They serve three functions:
- Vault Recovery: If you lose access to your passkey, guardians can help reconstruct your vault key so you can regain access.
- Release Authorization: If configured, guardians initiate the release by confirming the succession event.
- Passive Protection: During your lifetime, shares remain dormant.
Who to Choose
Ideal guardian choices:
- A trusted attorney, notary, or financial advisor (institutional reliability)
- Family members in different geographic locations (geographic diversity)
- Close friends with stable email access
Diversity principle: Never choose guardians who could all become unreachable simultaneously (e.g., all living in the same city).
Managing Guardians
While your vault is active, you can add, remove, or replace guardians at any time.
- Navigate to People → Guardians in your dashboard.
- Click Add Guardian.
- Enter their name and email address.
The guardian receives an email invitation to accept their role. Changing the guardian set regenerates all key shares, rendering previous shares invalid.
Silent Directives: Tell your guardians you have appointed them. They will receive an email to accept, but they won't know the vault contents or the heirs involved.