Get past the hardware and there's the OS. Past the OS, the application. Past the application, the cryptography. Each layer is designed to exhaust a different kind of threat. Defeat the encryption and the air gap still holds. Defeat the hardware and the ceremony still blocks access. There is no single path through.
Physical isolation is the precondition for everything above it. A compromised OS can't steal what it can't touch. No reach, no attack.
Air gap is not a setting. It is physics.
Air-gapped hardware is necessary, not sufficient. A bloated OS carries services, daemons, and places an attacker could write to or corrupt. Hardening means removing everything that isn't Vault OS — no browser, no mail client, nothing else to compromise.
A service that doesn't run can't be exploited. A filesystem that can't be written to can't be infected.
Before the application touches cryptographic material, three decisions have to be right: what language it's written in, whether the binary can be independently verified, and whether network calls are structurally impossible. Get any one wrong and you've left a gap in the perimeter.
Network calls aren't blocked at runtime. They can't be compiled in. The program was never written to make that call — there's no call to intercept.
Memory-hard: each guess requires a full pass through RAM, with no shortcuts and no way to parallelize the work.
Derives two independent subkeys. Compromising one reveals nothing about the other.
Encrypts and authenticates. Any modification (even one bit) is detected on read.
65 MB RAM per guess. GPU clusters can't parallelize it. An attacker running full clusters would still be guessing long after the hardware running it is a museum piece.
Two keys derived independently. A flaw in one key's usage tells an attacker nothing about the other.
Encryption is the lock. Authentication is the seal. A lock keeps people out — a seal tells you someone was already in. One tampered bit and the vault won't open.
Holding the Vault Drive gets you nothing. Think of a safe-deposit box that requires two keys held by two different people — neither one can open it alone. The vault works the same way. The drive is encrypted with a passphrase split across Vault Cards. A "ceremony" here means a required gathering: the right people, the right cards, the same room. Without that quorum, the vault cannot be opened.
Your heir must bring the right people together, in person. A vault that one person can open alone is a vault that one person can be forced to open — under pressure, or in grief.
The top layer isn't about cryptography. It protects against vendor shutdown, media failure, and any attempt to force the vault open before its time — whether through a court order or physical coercion. A vault that stops working when we do isn't really yours.
You're not trusting us to stay in business. You're trusting math that has been public for decades.
No subscription, no telemetry, no cloud dependency — just math that doesn't expire.
Your instructions are sealed inside. When you're gone, your family will know exactly what to do.