A vault that opens only from the inside

Most key-loss stories end the same way: the secret lived in one place, and that place stopped existing. We designed our storage to fail in the opposite direction, and the design is worth sharing because it is simple.

The secrets themselves are encrypted with a master key that only exists while an authorized session is alive. A copy of the database without that session is inert. Cold process, locked vault. That is fail-closed, and it is deliberate.

The second half is the promise that locked is not lost. On a schedule, the system opens every single secret it holds, one by one, and counts what actually decrypts. The count lands on a screen the owner can read, and any failure is named, never averaged away. Last drill: 248 of 248 entries opened, one placeholder listed honestly as holding no key material. A sealed backup is written only after the drill passes.

Recovery is rehearsed, not assumed. We have restored the full set of keys from a sealed snapshot and proved the result by opening every entry again. The whole exercise leaves nothing sensitive on disk in plain form.

Trust is easier to keep when you can show the receipts. Ours are mechanical, timed, and boring on purpose, which is exactly how custody should feel.