AmberKeyConnecting your estate advisor
If you work with an estate planner, a family office, or a fiduciary, you can let their firm see whether your AmberKey plan is current and how covered it is. This is optional. Most people never turn it on, and nothing about your plan depends on it.
What it buys you is a second pair of eyes. Plans go stale quietly: a backup that has not been refreshed in two years, a recovery card nobody has confirmed since you printed it. An advisor watching the dashboard notices, and nudges you.
What your advisor can see
A status summary, and nothing else:
- whether you are checking in on schedule
- the date of your last check-in
- how much of your plan has a recovery path confirmed within the last year
- how many of your printed cards have been confirmed recently, as counts
- when you last exported or synced your family backup
- whether your executor packet is complete
- whether a release is in progress
- the name you chose to show them, if you set one
What they can never see
Your accounts. Your passwords. Your keys. Your letters. The contents of your vault. The names, emails, or phone numbers of the people in your recovery circle. Your own email address.
This is not a policy we promise to follow. Our server holds your plan only as ciphertext it cannot open, so there is nothing for it to hand over. Your advisor sees a fixed list of status fields, and that list is published in our threat model.
They also cannot change anything. The connection is read-only. An advisor cannot edit your plan, add or remove people from your circle, start a release, or stop one. If your advisor’s account were compromised tomorrow, the attacker would learn that a plan exists and roughly how healthy it is. They would not be able to open it or interfere with it.
Connecting
Two ways, and both put you in control.
Your advisor sends an invitation. You get an email with a link. Follow it, sign in or create your account, and the connection is made. You will see a confirmation naming the firm.
You enter their firm code. Ask your advisor for their firm code, a short
string like 7K3P9QZ2. In AmberKey, open Settings, find Your advisor,
enter the code, and connect.
The name your advisor sees
Our server does not know your name, so your advisor’s dashboard cannot show it unless you decide to.
When you connect, AmberKey asks for the name you want your advisor to see, and prefills it with your profile name. Accept it, change it, or clear it. If you leave it blank your advisor sees a short code instead, which is fine but makes you hard to tell apart from their other clients.
The name is per firm. If you connect to two firms you can show each a different one. You can change it later in Settings, under Your advisor.
Only this label is shared. Changing it does not change your account name, and your advisor never sees your email.
Disconnecting
Open Settings, find Your advisor, and choose Disconnect beside the firm.
It takes effect immediately. The next time their dashboard tries to read your status it fails, and you disappear from their roster. Your advisor cannot object, delay it, or be given a chance to act first. The disconnection is recorded in their firm’s audit log, so there is a record that it happened, but that is all.
You never need permission from your advisor to leave, and you do not need to tell them first.
What this does not change
Connecting an advisor does not make them part of your recovery circle, and does not give them a card or a share. They are not involved in a release: they cannot start one, cannot approve one, and cannot block one. If your firm closes or you part ways, your plan continues to work exactly as it did before.
If you do want your advisor to hold a recovery card, that is a separate, deliberate decision you make when setting up your circle. Many firms will not accept one, for their own liability reasons. See Your recovery circle.