Three promises.Every scenario, named.
Trust isn't a feeling. It's the absence of unanswered fears. Here is the shortest list we could write of every fear that could matter to you, with the answer beside it.
In plain English, with the math underneath.
Most crypto products lead with technical proofs. We lead with the promises those proofs are there to keep.
- 01
Your assets stay yours.
OwnershipYour crypto sits in a vault that only your wallet can change. We have no key. No admin button. No way to move your funds. Ever.
Like a safe-deposit box where the bank holds the room, you hold the only key. Except here, even the room is yours.
- Open-source contracts (MIT). Read every line.
- Audited end-to-end by OpenZeppelin
- Verifiable bytecode on every chain
- No upgrade backdoor for HeirVault
- 02
Your plan can't be hijacked.
IntegrityOnce you set the rules (who inherits, when, how much), nobody can rewrite them. Not us. Not a hacker. Not one family member alone.
Like a sealed will at a notary. The terms are visible, but the seal is mathematical.
- 51 formal proofs (Halmos symbolic execution)
- 10,000-run fuzz tests · 512-run invariants
- Commit-reveal anti-frontrunning on every claim
- Family quorum (M-of-N) required for inheritance
- 03
There's always a way back.
ReversibilityLose your phone, change your mind, or just want to pause? You can. There is no scenario where one bad day costs you your estate.
Like a fire alarm with a 7-day cancel window. Pulling it doesn't burn the building down.
- Account recovery: guardian-gated, 7-day cancel window
- Pause the vault any day; auto-resume after 7 days
- Cancel a claim during the 20-minute reveal window
- Override guardians with heir consensus if needed
You hold the keys. Every single day.
We don't keep a copy. We don't hold a backup. We don't have an admin button. Here is what you see, and what each part of it actually does on-chain.
- Health ring
On-chain proof that you have checked in within your chosen cadence. Green stays green so long as you do. Nothing off-chain can fake this.
- Countdown
The next time you need to tap "I'm here." Set it to 30, 90, or 180 days. Change it any day — only your signed transaction does.
- Quick actions
Check in, deposit, change rules. Every button is a single signed transaction. No HeirVault button can move your funds.
Figure 3Owner dashboard at the start of month five. Health 87, next check-in 47 days. State drawn live from the smart contract; HeirVault servers cannot edit it.
Every scenario we could think of, named twice.
The left column is the threat. The right column is the specific on-chain mechanism that defeats it. Each row is a row because the right column already exists.
- 01Attack
An heir front-runs the claim
- 01Quorum signs the claim transaction.
- 02Attacker watches the mempool, sees the funds about to unlock.
- 03Submits a higher-gas transaction to drain the vault first.
Mitigation20-minute commit–reveal window
- 01Quorum signs a hashed commit, not the unlock itself.
- 0220 minutes pass on-chain. Anyone watching sees only the hash.
- 03Only the original signers can then reveal — front-running is impossible.
- 02Attack
One compromised heir tries to drain
- 01Attacker takes one heir's wallet and seed.
- 02Submits a claim from that wallet.
- 03Hopes one signature is enough.
MitigationM-of-N quorum, enforced by contract
- 01Vault requires at least two signatures, always.
- 02The compromised wallet alone never reaches threshold.
- 03The other heirs see the suspicious claim and can pull the alarm.
- 03Attack
HeirVault disappears
- 01Our website goes dark. Our domain expires.
- 02Email stops, support stops, founders unreachable.
- 03Your family doesn't know what to do.
MitigationRecovery URL is public, on-chain, mirrored
- 01Recovery instructions are mirrored on IPFS and GitHub.
- 02Guardians sign EIP-712 messages that verify on-chain.
- 03HeirVault servers cannot block, delay, or intercept anything.
What can happen.And what cannot.
Trust is built when fears are named, not avoided. Here is the shortest list we could write of every scenario that could matter to you.
- Pause the vault any day, for any reason.
- Change heirs, shares, and stewards while you're alive.
- Cancel a claim during the 20-minute reveal window.
- Reset stewards (your trusted extenders) with heir consensus.
- Recover access to the vault if you lose your wallet (7-day window, you can cancel).
- Cancel all standing orders in a single transaction.
- Move chains. Use 1 chain or 9. The plan stays the same.
- Move your funds. Ever.
- Change your heirs, shares, or rules.
- Force a claim. Force a recovery. Force anything.
- See your seed phrase. We don't have it.
- Disappear and take your assets with us. The vault is yours, on-chain.
- A single heir cannot claim alone. Your family quorum is required.
- A hacker who takes one wallet cannot drain the vault.
- A steward cannot take time away from you, only grant more.
- A bug-bounty researcher can only earn rewards, never reach your funds.
- A court order cannot make us hand over keys. We don't have any.
What happens if…
Pick a fear. Watch what actually happens. We built every one of these flows to be visible end-to-end, so you don't have to take our word for it.
If I disappear for six months
Step 1 of 6- Day 0
You miss your monthly heartbeat.
- Day 30
Reminder emails go out: to you, and to anyone you set as a contact.
- Day 90
Your grace period ends. Your stewards can offer you more time. Your family can begin a claim.
- Day 91
Your named recipients sign together. Your family quorum, M of N.
- Day 91 + 20 min
The 20-minute cool-off elapses. If anything is wrong, you can pull the alarm.
- Day 91
Each recipient pulls their share, on their own time, on the chain you chose.
Your family quorum signs together, waits 20 minutes for the cool-off window, and pulls each person's share. No single heir acts alone.
Two answers most products avoid.
The vault earns while it waits. The recovery flow runs whether we exist or not. Both are on-chain mechanisms, not promises.
You can lose the walletand still come back.
The first question most people ask is also the right one: "What happens if I lose my wallet tomorrow?" Here is the answer, end to end.
Recovery is gated by people you choose. It runs on a seven-day clock. You can cancel it at any point during that window. We never hold a key, never approve a recovery on our own, and never can.
See the contract that enforces this →- Day 0
You realize.
Lost phone. Stolen wallet. Forgotten passphrase. Whatever it is, you tell us and your guardians from any device, any country.
- Days 1–3
Your guardians sign.
The trusted people you named at setup confirm it's really you. They sign with their own wallets. We don't have keys to anything.
- Days 1–7
You can cancel.
Even after guardians sign, the seven-day window is yours. Pull the alarm, change your mind, anything. We default to slow.
- Day 7
Access restored.
If nothing was cancelled, your vault is now controlled by your new wallet. Heirs, rules, balances. All preserved exactly.
- Guardian-gated
- Recovery only proceeds with your chosen guardians' signatures.
- Owner-cancellable
- You can cancel during the entire 7-day window. Bad day, no problem.
- Heir-overridable
- In the rare case of guardian collusion, your heirs can reset stewards together.
Ready to set this up?
Set up takes about 10 minutes. Or book a 30-minute call and we'll sit beside you while you do it. We never see your keys.