Dead Man's Switch
An optional handoff that gives one person you choose a sealed, read-only copy of what you select, and only if you stop checking in. It runs end to end between your device and theirs, with no server in the middle.
The Dead Man's Switch is an optional handoff for the case where you can no longer open your vault yourself. You choose what goes into a separate Recovery Vault, you name one trustee, and you set how long your silence has to last. If you stop checking in for that long, your trustee can release the Recovery Vault on their own device as a read-only copy. Until then they have no access to any of it.
It is off until you turn it on, and it never changes how your vault behaves while you are using it.
At a glance
- What is handed over: a separate Recovery Vault holding only the record types you tick, kept up to date in the background.
- Who receives it: one trustee, invited by Apple Account.
- When: after a check-in window of 30, 60 or 90 days, plus a grace period of 7, 14 or 30 days.
- Who decides: your trustee's device, evaluating your signed policy locally. No server of ours is involved.
- What they get: a separate, read-only vault. Your own vault is never touched.
- Requirements: iPhone or iPad, iCloud signed in, a paid plan to enable it.
What you set up
Arming the switch takes three decisions. Settings › Dead Man Switch walks through them in order.
1. What the Recovery Vault holds
The Recovery Vault is a separate vault with its own encryption key. You tick the record types that belong in it: documents, photos, passwords, passkeys, identity records, and your own custom record types. Anything you leave unticked is never copied out of your Primary vault.
Once armed, the app keeps the Recovery Vault current in the background, so what your family would receive reflects your vault as it is now, not as it was on setup day. Records are selected from your Primary vault; sensitive vaults and shared vaults are not included.
2. Your trustee
One person, invited by their Apple Account, either an email address or a phone number, and confirmed with Face ID. Their device creates its own key pair and keeps the private half. Your app wraps the Recovery Vault key to their public key and stores that wrap alongside the vault.
The invitation only works for that Apple Account. Until the policy says otherwise, the wrap is all they hold, and it opens nothing.
3. Your check-in policy
Choose how long silence has to last before anything can happen.
| Setting | Choices | Default |
|---|---|---|
| Check-in window | 30, 60 or 90 days | 60 days |
| Grace period | 7, 14 or 30 days | 7 days |
| Check-in mode | Automatic or manual | Automatic |
In automatic mode, unlocking any vault on your iPhone counts as a check-in, so ordinary use keeps the clock at full without you thinking about it. In manual mode you tap "Check in now" instead. Either way, checking in at any point resets both the window and the grace period.
The switch never makes your vault less private today. It only answers the question of what happens if you can no longer answer it yourself.
No server in the middle
Most products that offer this run a timer on their own machines. Something on their side counts the days, decides you are gone, and mails out your credentials. That asks you to trust a company to hold the keys, stay in business, and get the decision right.
Kinship Vault has nothing in that path. The parts divide like this:
| Part | Role | What it cannot do |
|---|---|---|
| Your iCloud account | Carries the encrypted Recovery Vault, your signed policy and a signed note at each check-in | Run a timer, decide anything, or read what it carries |
| Your device | Encrypts the Recovery Vault, signs the policy and each check-in | Reach your trustee's device directly |
| Your trustee's device | Evaluates the policy locally, then decrypts after an explicit release | Forge a check-in, move the deadline, or open anything early |
| Kinship Vault, the company | Nothing. There is no account with us and no server in the flow | See your policy, your trustee, or your records |
Eligibility is judged against time taken from iCloud rather than the device clock, so moving a phone's date forward does not bring a release closer. Everything you sign is verified against the key your trustee's app pinned when they accepted the invitation, so a substituted policy or a forged heartbeat is rejected.
Watch the whole handoff
A minute of real screens, both sides. Arming the switch and choosing what the Recovery Vault holds, inviting the trustee, the status screen counting down, then the trustee's phone noticing the deadline has passed and releasing the vault as a separate read-only copy.
The Dead Man's Switch, owner side and trustee side. Open the video directly.
What your trustee sees, stage by stage
| Stage | On their device | Their access |
|---|---|---|
| Invited | An invitation to accept, naming you | None |
| Watching | "You are your name's trustee", and that a sealed copy is on the phone | None. No records, no filenames, no counts of your content |
| Eligible | A banner and a local notification saying a release is available | Still none until they release |
| Released | A separate vault beside their own, marked read only | Read and copy out. No edits, ever |
They cannot shorten your deadline, extend it, or trigger a release early. Releasing is always a deliberate act on their side, confirmed with Face ID, and only offered once both your check-in window and the grace period have passed.
Changing your mind
Everything stays adjustable for as long as you are here.
- Check in at any point and the window and grace period both reset to full.
- Change the policy or the contents whenever you like. The Recovery Vault re-mirrors to match.
- Change the trustee and the Recovery Vault is re-keyed, so the outgoing person's copy stops updating. If their phone is online it is told to clear the copy it holds.
- Turn it off and the shared area is deleted outright, which removes the copy from your trustee's phone the next time it connects.
If a release has already happened and you are still here, the app notices your next check-in and tells your trustee you are back. Updates to their copy pause until you decide whether to keep feeding it or turn the switch off.
Requirements and limits
- iPhone or iPad to arm the switch, set the policy and name a trustee. A desktop app that may sit closed for weeks cannot promise the long-lived reminders this depends on, so the owner side is not offered on Mac.
- A trustee on a Mac does see their status there, including when a release becomes available. The release itself is done on their iPhone.
- iCloud signed in on both sides, and Strict Offline Mode turned off, since the handoff travels through your own iCloud account.
- A paid plan to enable the switch or change the trustee. An armed switch keeps running even if the plan lapses, deliberately: someone who has died cannot renew, and tearing the handoff down at that moment would defeat the entire point.
- One trustee at a time in this version.
Related
- How recovery works, the three independent ways back into your own vault.
- Recovery Network, splitting your key across trusted people. Separate from the Dead Man's Switch, and a good companion to it.
- What is a dead man's switch?, the plain-English version of this page.
Set it up once, then forget it.
Settings › Dead Man Switch on your iPhone. Three decisions, one conversation with the person you name, and it stands guard quietly from then on.
Back to the documentation