How it works

Careful by design, simple in practice

You set things up once. After that, AmberKey mostly stays out of your way, with an occasional check-in and an annual reminder, until the day your family needs it.

1. You build your packet and vault

   A guided interview walks through your digital life: home, money, digital, wishes. Instructions and account information go in the executor packet. The few true secrets (wallet seeds, your password manager's master credential, device passcodes) go in the vault, which is encrypted on your device before anything is stored. We never see the contents. Bank and credit card passwords are never stored anywhere. Here's why.

2. You choose a recovery circle

   A handful of people you trust: typically a spouse or partner, children, and perhaps an attorney or close friend. The vault's key is mathematically split among them so that no single person can open it, but the right combination can. You'll see exactly which combinations work, in plain sentences like "Maria and both kids can recover. The kids alone cannot."

3. Everyone gets a printed card

   Each circle member holds one card: twenty ordinary words, a card ID, and instructions. No names, no hints about who else holds cards. Circle members need no accounts and no apps. Everything they'll ever do happens through one-time links we send them, or on paper. A card alone reveals nothing at all.

4. Quiet check-ins confirm you're fine

   On a schedule you pick (every 30, 60, or 90 days), we ask you to tap a link. That's it. Circle members also get a brief quarterly "is your card still safe?" check, so a lost card is noticed years before it matters.

5. If you go silent, we escalate slowly

   A missed check-in never triggers anything dramatic. We nudge by email, then by text, then quietly ask a trusted contact, each stage a week apart. Only after all of that does your circle gain the ability to ask. Any check-in from you, at any stage, resets everything instantly.

6. The ceremony — with a veto window

   When a circle member starts a recovery, everyone is notified, including you, on every channel we have. Then nothing happens for a veto window you chose (3–14 days). If you're alive, one tap cancels it. Only after the window closes and enough of the circle confirms does anyone receive the encrypted vault, which they still must unlock together, offline, with their printed cards.

7. Your family follows the packet

   The first page is an executor checklist that begins with what matters most. Every account has a playbook: what to do, whom to call, what documents to bring, what to expect. Written for a grieving reader, not a technical one.

The escalation ladder, exactly

This is the real state machine, not a simplification. Your base check-in interval is 30, 60, or 90 days, your choice. Each later stage adds a 7-day grace period.

"Quorum eligible" releases nothing. It only unlocks the circle's ability to initiate the ceremony above — veto window and all. A circle member with a death certificate can initiate immediately without waiting for the ladder; the veto window still applies. And any check-in from you, at any state, returns everything to ACTIVE.

What the ceremony protects against

Or go deeper first: security & threat model.