Backup
What an inheritance arrangement has to keep, who keeps each part, and the document that makes it recoverable by somebody who has never used the app.
Every backup in this guide has two halves. Your recovery words restore your keys. Your wallet backup restores your records: which money is yours and how to spend it. Keep both.
An inheritance wallet has four parts, and the two extra ones are what make it recoverable by people who were not there when it was set up.
| Part | What it is | Who keeps it |
|---|---|---|
| Key material | Each participant's own recovery words or shares | Each participant, separately |
| Wallet backup | The records: which outputs are the wallet's, and how to spend them | The wallet, and an encrypted export |
| The configuration | Which keys, what threshold, what period | Every participant |
| The pre-signed transaction | The succession route, with its lock time | Every beneficiary on that path |
Important
The last two are what fail. A quorum of people holding valid keys and no configuration cannot construct a spend. A beneficiary holding a key and a stale transaction cannot use the succession path. Neither failure is visible until the moment it matters.
Why the pre-signed transaction is different
The succession route is a transaction signed in advance, so it is a file that has to be kept, and that goes out of date every time money moves in or out of the wallet. An old copy stays valid until the money it spends moves, and it never covers money received after it was signed.
That makes it the only part of this backup that changes regularly.
Do
Rebuild and redistribute it automatically after every payment in or out, and show on the home screen when a beneficiary is holding an out-of-date copy.
Don't
Treat it as a one-time export during setup. It will be wrong after the first payment.
The recovery document
The most valuable artefact in this design, and the easiest to skip.
A printable document that lets somebody recover the money without the app, without the company, and without having been told how any of this works. Written for a person who has just been bereaved and has never heard of a threshold.
It should contain:
- what this is, in two sentences
- who holds which key, and how to reach them
- where the current succession transaction is kept, and by whom (not the transaction itself, which changes after every payment)
- the wallet configuration, as text and as a code
- what to do first, as numbered steps
- the names of at least two open tools that can read it
- the date it was produced
Do
Write it for somebody who will read it once, under stress, possibly years from now. No jargon, no screenshots of an app version that will not exist.
Do
Regenerate it whenever the arrangement changes, and date it clearly so an old copy is recognisable as old.
Don't
Put key material in it. It is a map, not a key. It should be safe to leave with a solicitor.
Where things go
The rule is that no single place holds enough to spend, and no single loss stops recovery.
Do
Walk the owner through it as places rather than categories: "Your words at home. A copy of the document with your solicitor. Christina has her own key and a copy of the document."
Do
Check the recovery path assumes the owner's devices are gone. Every step that needs something only on their phone fails at exactly the moment it is needed.
Don't
Put the configuration and a quorum of key material in the same place. Together they are the money.
Testing it
Do
Run a full drill before the wallet holds anything real: fund it, export everything, delete the owner's installation, and have a beneficiary recover using only the document and their own key.
Do
Repeat the drill when anything changes. An arrangement that worked at setup and has had two key replacements since has not been tested.
Recommendation
If the drill cannot be completed by somebody who was not involved in setup, the arrangement has not achieved what it exists for, however correct the cryptography is.
Open questions
- Which open tools can read a BSV multi-key configuration and a pre-signed transaction today? If fewer than two, what should the document tell a beneficiary instead?
- Can someone who was not involved in setup complete the drill using only the document? Run it as a usability test.
- Is a configuration safe to leave with a solicitor, given that it maps who holds which key?
Related
- Backups: the two halves, in general
- Succession: what the document is for
- Making changes
Written from: BRC-38, BRC-39, BRC-42, BRC-75, BRC-140, ts-stack script docs.
Checklist
The rules on this page, in a form you can work through.
11 rules