The most important question you can ask of an inheritance product is who actually decides. For the wallet assets, the answer is a program on Solana.
What the program is
A small on-chain program that owns two accounts per user:
- A configuration account holding the owner, the heir, the confirmation flag, the last heartbeat, both timers, and the claim status.
- A vault account that physically holds the deposited assets.
Both are derived deterministically from the owner's address, so anyone can find and read them without asking us anything.
What it enforces
Every instruction re-checks its own constraints:
- Start a claim
Requires the caller to be the heir, the heir to be confirmed, no claim already active, and the inactivity timer to have genuinely elapsed.
- Finalize a claim
Requires a live claim and the full challenge window to have passed.
- Withdraw assets
Requires the claim to be finalized and the caller to be the heir.
- Owner actions
Require the owner's signature, and are refused once an estate is finalized.
The heir must sign each of their actions. They are not merely named in an account — they have to prove control of the key, every time.
Where time comes from
From Solana's clock, read by the program as each instruction executes. Not from our servers and not from your phone.
A compromised device cannot make the timer appear to have elapsed. Neither can we. Neither can your heir.
Why there is no override
There is no privileged caller. The program has no admin instruction, no pause, no emergency release. Every path through it is the same path your heir would take, subject to the same checks.
That is a deliberate trade, and the cost is real: in a genuine emergency nobody can accelerate anything either. See what we cannot do.
What the backend is for
There is a backend, and it is worth being clear about its role in the asset path: it has none.
It sends notifications, stores encrypted vault blobs, and indexes public on-chain state so screens load quickly. It holds no signing authority over your assets and cannot move, freeze or release them. If it disappeared tomorrow, your heir could still claim by interacting with the program directly.
The vault is a different story
The asset path is purely on-chain. The vault's release path is not — it cannot be, because a public ledger cannot hold a secret. The backend does play a role in vault release today. That difference is set out in known limitations, and it is the most important thing on that page.
Verifying it yourself
The program's accounts are public. Any Solana block explorer will show you the configuration for any address: the heir, the timers, the last heartbeat, the claim status, the deposited balance.
An heir can check their position without trusting the app, the owner, or us. So can you.
Current status
The program runs on Solana devnet during the beta, and has not yet been through an external security audit. Both of those are stated plainly in known limitations, and both should weigh on how much value you commit today.