Engineering

Deciding when: inside life-event verification

Releasing early is a breach. Releasing late is a failure. How three independent layers answer the only question that matters.

9 min read · Reep Tech Ltd

Encryption is the well-understood part of digital inheritance. Any competent team can store a secret nobody can read. The hard question is the one cryptography cannot answer: has the person died, and who gets to decide that they have?

Get it wrong in one direction and you have handed someone's private records to relatives while they were on a long hike with no signal. Get it wrong in the other and the vault sits sealed through the exact months a family needed it. Life-event verification is our answer, and it is deliberately built from three layers that do not share a failure mode.

Layer one: guardians

Between two and five people you name. When a verification request opens, two of them must independently approve before anything proceeds. The threshold is the point. One person acting from grief, haste or bad faith cannot move the vault, and one person being unreachable cannot stall it.

Guardians never see vault contents, before or after. They hold no fragment of your key. Their only power is to answer one question, and the record of how they answered it is written to the audit log.

Layer two: the heartbeat

A scheduled check-in by email, SMS or app. Confirming takes one tap. Miss the whole window and Reep does not open your vault, it opens a request and notifies your guardians.

The window is yours to set, and the choice is a real trade-off. Fourteen days reacts quickly and suits someone whose absence would be noticed within a fortnight. Ninety days suits people who travel, work offline or take long breaks from their devices. What matters is that inactivity alone never releases anything. It only starts a conversation among humans.

A missed reminder is evidence of nothing. It is a prompt to ask people who would actually know.

Layer three: the official record

Where it is available, a death certificate or registry match is checked before the final step, reviewed by a legal compliance partner rather than by an automated match. Not every jurisdiction offers a digital registry, and in those cases the certificate itself is reviewed manually. This layer is what makes the process defensible to an institution that has to act on it later.

Fail-safe, and reversible until the last moment

Each layer can stop a release on its own. None can complete one alone. And until the final step executes, a single check-in from you cancels everything and stands the guardians down, which is exactly what happens when the cause was a broken phone rather than a death.

You can run the whole sequence yourself, including the cancellation, on the home page simulator. It uses the same state machine the product does.