Security in detail

Your heirs receive an email with a link. The link only leads to the app, without any data or keys (so intercepting it gets nobody anywhere). By video call they identify themselves to your trusted people: the video shows the right person, a short code the right device. Only after that, and only once the protection period since the report has run out, does each trusted person send their key share, encrypted just for them. On their devices the key comes together locally and the box opens. No trusted person ever sees a login along the way.

Then exactly the same method keeps running, with the same app, without us altogether: each trusted person sends their encrypted key share directly (by email, WhatsApp and the like, QR code or USB drive), the encrypted box comes along once, and the app puts it together locally on the heir's device. The same app, the same security; only the delivery route is different. The secure part (encrypting and putting it together locally) is always done by the app on the devices anyway; as long as we exist, we only take care of the organizational part around it: notifying and forwarding. Only your trusted people can release anything. We never can.

AES-256, the same standard banks and governments use. Your key is created on your device and only ever leaves it encrypted; the split among trusted people uses Shamir Secret Sharing. In practice this means: if your laptop is stolen, your vault stays shut. What is missing is the thing only you can open it with.

To BSI IT-Grundschutz (the standard of the German Federal Office for Information Security) and OWASP (the international standard for secure software). We publish every independent security audit as soon as it is available.

Only as much as you give it, and it can be fully switched off. The market overview works with general market data and the categories of your assets (e.g. “equity funds”, “gold”), not with the secrets in your vault (passwords, notes, crypto seed phrases). Those leave your device only encrypted and stay unreadable for us too. The Ask Heldena chat is fed by you alone, with what you type into it. Anyone who wants no AI at all switches it off completely in Settings. Then nothing is sent to it.

Your key is split into several parts (Shamir Secret Sharing) and kept with your trusted people. No one can reconstruct it alone; the minimum number fixed for your circle is always needed. Every recovery through Heldena also has to wait out a protection period in which you can stop it. But if as many of them as the minimum number secretly team up, no technology can prevent it; that is why it matters whom you choose.

Nothing you need to take care of. It sorts itself out. If a trusted person loses their password, their key share is gone (it was tied to exactly their account). They click “Forgot your password?” as they would anywhere, set a new one, and automatically get a new key share in the process; the old one no longer counts. No one has to step in, not even you. (Technically: your device calculates the new key share and encrypts it to their new key. The server stores only encrypted data, and no one can read it, not even Heldena. If you have already died, the redundancy steps in: the remaining key shares are enough.)

It protects against identity theft. If someone pretended to be you and tried to recover your access onto THEIR device, you would be warned at once on all your channels and stop it with one tap (veto). If it really is you, you wait out the period just once. It lasts 14 days: long enough for you to notice misuse, short enough that you are not locked out of your own vault for weeks. There are two different protection periods, and the difference has a reason: this one protects YOU while you are alive and can stop it yourself, which is why it is short. The period after a reported death (90 days) protects you in a situation where you may not be looking at your phone, which is why it is long.

No. Several trusted people have to confirm independently, and you are warned on your own channels and can stop everything (veto). A death certificate is not a required step. It could be forged and is not what makes it safe; the protection comes from the veto, the minimum number and the identity check of your heirs.

No. Time alone opens nothing. Without an active report, nothing happens at all, however long it takes: the 90-day protection period starts once one of your trusted people reports your death, and even once it has run out, access is released only if the minimum number has confirmed it independently. So a hospital stay triggers nothing. There is nothing you would have to stop, because nobody has reported anything. Through Heldena, it could only happen if your trusted people reported your death falsely. Then all other participants would see the report, and you can stop the case as long as you are able to. If as many of them as the minimum number team up, they need neither a report nor Heldena; no technology prevents that. That is exactly why you choose people for this role whom you trust to stay truthful.

No one can do that alone. It always takes the minimum number fixed for your circle, and that many would have to commit fraud together; a single trusted person is powerless. Through Heldena, no one gets past you even then, as long as you are alive: every recovery attempt is reported to you, has to wait out a protection period and can be stopped by you (veto). And on that route your trusted people never see your data, even after your death. Their key shares are encrypted only for your heirs and put together on the heirs' devices; so they only pass the access on instead of getting it themselves. But if as many as the minimum number secretly team up, they can put their key shares together without Heldena too, at any time; no technology prevents that. That is why it matters whom you choose. If you want it even safer, choose more trusted people, e.g. five instead of three: then three would have to commit fraud together instead of two, and it does not matter if two of them drop out at some point.