The vault has a harder problem than the wallet. A wallet key only ever needs to be used by one person. A vault key needs to become usable by a different person, later, under a condition neither of them can fake.
Envelope encryption
- 01
A key per item
Every item gets its own freshly generated 32-byte key, produced on your device. No key is reused across items.
- 02
Encrypted with authenticated encryption
XChaCha20-Poly1305, which both conceals the contents and detects tampering — a modified ciphertext fails loudly rather than decrypting to something else.
- 03
Bound to its identity
The plaintext envelope carries the owner, the item id and a version, and all three are re-checked on decrypt. A ciphertext moved between items or replayed from an older version fails.
- 04
Only ciphertext is stored
The encrypted payload goes to storage. The plaintext never leaves the device.
Splitting the key
The item key itself is then split using Shamir secret sharing into several shares, distributed to separate parties. A minimum number of shares — the threshold — is required to reconstruct it, and any smaller number reveals nothing at all about the key. Not a partial key, not a head start on brute force. Nothing.
- Cipher
- XChaCha20-Poly1305 (authenticated)
- Key size
- 256-bit, random per item
- Key splitting
- Shamir secret sharing over the item key
- Where the key is never stored
On-chain. Solana state is public — the chain holds the condition, never the secret.
The gate
Reassembly is conditional. Before shares are released to an heir, the on-chain inheritance account is read live and must show:
- The claim status is finalized, and
- The requester is the confirmed heir for that estate.
Read live, every time, with no cached verdict. That is what makes a cancelled claim close the vault instantly: an heir who was authorised a second ago is not authorised now, because there is no stored "authorised" to rely on.
The owner's own access follows the mirror rule — available while the estate is active, closed once it has finalized.
Files
The same design, applied to bytes. A file is encrypted on device with its own key before upload; the stored object is ciphertext. A checksum recorded at encryption time is verified on retrieval, so a corrupted or substituted object is detected rather than silently decrypted.
What the storage sees
Ciphertext, and the metadata needed to list it: item titles, categories, types, sizes and timestamps. Titles and categories are deliberately unencrypted so a list can be rendered — which is why naming discipline matters. See what your heir sees before release.
Being precise about the trust model
The wallet's inheritance is enforced entirely by a program on Solana. The vault's release cannot be, because a blockchain cannot hold a secret — anything on it is public.
So the vault distributes key shares across separate parties and gates their release on the chain. That is genuinely different from a service holding your data and promising to release it responsibly, and it is genuinely weaker than the purely on-chain guarantee the assets enjoy.
The current share distribution, and the work to widen it to more independent parties, is described honestly in known limitations. Read it before you decide how much to put in the vault.