Security
Built to be trusted with the things you can't replace.
Your documents and notes use bank-level encryption so features like search keep working. Your passwords go further, with end-to-end, zero-knowledge encryption that not even Kistkeep can read.
Everything else: bank-level encryption
Documents, notes, messages, and diary entries are encrypted at rest and in transit with AES-256, the same standard used across the industry. It's built this way deliberately, so features like search and smart document extraction keep working for you.
Passwords: zero-knowledge, end-to-end
Your Passwords vault is unlocked by a separate master passphrase that Kistkeep never sees, not your login password. We only ever store ciphertext. No one at Kistkeep, and no attacker who breaches our servers, can read what's inside.
How access actually releases
Nothing ever unlocks on a timer alone. Release always requires a human-reviewed report.
- 1
You choose who sees what, and when
Grant each trusted contact living access now, or set a release condition for later. Nothing changes until you say so.
- 2
A report comes in
A trusted contact or reporter lets us know something has happened, a death or incapacity, with any supporting information they have.
- 3
A human reviews it
Our team checks the report carefully before anything changes. There's no automated "dead man's switch" that fires on its own.
- 4
Exactly what you chose, unlocks
Only the contacts and items you configured become accessible, nothing more.
How the Passwords encryption chain actually works.
Four layers, each one unlocking the next, so a single leaked value is never enough on its own.
Master passphrase
Set once, separate from your login password. Run through Argon2id, the memory-hard hashing algorithm OWASP recommends for password storage.
One-time recovery key
Shown once at setup, the only backup route into your vault if you ever forget your passphrase.
Vault Key
Unwrapped by your passphrase or recovery key, using XChaCha20-Poly1305 authenticated encryption, and never leaves your device unencrypted.
Per-entry Item Keys
Every password and secret gets its own key, wrapped by your Vault Key, so one compromised entry never exposes the rest.
A continuity guarantee, not just a promise
Digital legacy services have shut down before, taking families' stored data with them. That's the single worst outcome for a service built around trust across decades, not just years. Kistkeep is built around guaranteed data export and a continuity structure from day one, so your vault outlasts any single company's fortunes.
Threshold protection for your highest-value secrets
For things like a crypto seed phrase, Kistkeep supports threshold cryptography (SLIP-39), splitting a secret across several trusted contacts so no single person can access it alone, but the right group together, once your release condition is met, can.