What happens to your domains and cloud logins if you disappear? Building an encrypted vault for solo founders

dev.to2026-11-11 18:570 views

If you run a company alone, a lot of it lives in one head: the registrar login, the payment processor, the cloud account, the app store accounts. If something happens to you, nobody knows those exist, let alone how to get in. I built Heirloom: Founder Vault to deal with that, and this post covers the design choices.

What it does

You record the important accounts and assets, and name up to 5 beneficiaries who get read-only access only when you can't respond. That's the whole idea. It's closer to a binder for your successors than a password manager.

Stack

React Native with Expo (no native folders checked in), WatermelonDB for local storage, Expo SecureStore and local authentication for biometrics, Supabase on the backend, RevenueCat for purchases.

Encryption of exports

For encrypted exports I use AES-256-GCM, which is authenticated encryption, so tampering is detected rather than silently decrypting to garbage. The key comes from your passphrase through PBKDF2-HMAC-SHA256 with 210,000 iterations (OWASP's 2023 guidance for that KDF) and a random 16-byte salt per export. The libraries are @noble/ciphers and @noble/hashes, which are audited and pure JS, so there's no native crypto module to maintain. The KDF parameters are stored beside the ciphertext so older exports stay readable if I raise the iteration count later.

The hard part is not crypto

The hard question is the trigger: how do you decide someone really can't answer, without false alarms and without being gameable? The app is built around a regular check-in: you confirm you're fine, and access only opens when check-ins stop. I would not call the trigger design solved. I'd like opinions from people who have thought about dead-man's-switch design.