Authentication Methods

SovSeal employs rigorous authentication to ensure only authorized individuals can access protected assets. Our verification methods differ for vault owners (everyday access) and heirs (inheritance access).

Vault Owner Authentication

Passkey Authentication

SovSeal's primary authentication uses passkeys — the most secure authentication standard available:

• Phishing-resistant: Passkeys are bound to specific domains
• Hardware-backed: Stored securely in device security modules
• Biometric-optional: Enable Face ID, Touch ID, or PIN
• Cross-device: Sync across your authorized devices

Hardware Security Keys

For users requiring additional security, SovSeal supports:

• FIDO2/WebAuthn keys: YubiKey, Google Titan, and compatible devices
• Multi-key registration: Register multiple keys as backups
• Requirement policies: Optionally require hardware key for all access

Biometric Verification

Where available, enhance authentication with:

• Fingerprint recognition
• Facial recognition
• Device-specific biometrics

Heir Verification

When your configured release conditions are met, trusted contacts must complete rigorous verification before accessing vault contents.

Multi-Factor Verification

Heir authentication includes multiple independent factors:

Verification Process

When release conditions trigger:

1. Trusted contacts notified via email and SMS
2. Identity verification initiated
   - Government ID upload and verification
   - Liveness check (optional)
3. Knowledge-based authentication
   - Answer security questions configured by vault owner
4. Multi-signature approval (if configured)
   - Other trustees confirm release
5. Staged access granted
   - Heir sees only designated files

Verification Levels

Verification rigor scales with asset sensitivity:

You control the verification level for each heir.

Activity Monitoring

SovSeal includes optional activity monitoring to detect inactivity that might trigger release conditions:

Connected Account Monitoring

• Email activity detection
• Social media presence monitoring
• Optional third-party account connections

Check-In Mechanisms

• Periodic confirmation requests
• Customizable check-in frequency
• Grace periods before release initiation

Account Recovery

Recovery Codes

When you create your account, you receive one-time recovery codes:

• Store these securely, separate from your vault
• Each code can be used once for emergency access
• We recommend storing in a physical safe

Trusted Device Recovery

If you lose access to your primary authentication:

• Established devices may be used for recovery
• Recovery still requires secondary factor
• We cannot bypass authentication for you

What We Cannot Do

Security Best Practices

We Recommend

1. Register multiple passkeys across different devices
2. Store recovery codes in a physical safe
3. Configure trusted device recovery
4. Consider a hardware security key for critical accounts
5. Review access periodically and update as needed

For Estate Planning

• Ensure trustees know how to access recovery codes
• Document authentication procedures for heirs
• Consider multi-signature for critical decisions

Related Topics

• Trusted Contacts
• Zero-Knowledge Architecture
• Release Conditions