A family office holds the credentials that hold the wealth. The accounts that pay the trustees, the wallets that hold the alternatives, the signing keys to the entities that own everything else. Lose those, and the wealth is unreachable for years.
One generation built the office. The credentials, contacts, and combinations were never written down because they did not need to be. When the next generation inherits, they inherit the wealth and the puzzle of how to reach it.
Stroke. Cognitive decline. A medical event that lasts months. The family needs to operate the office without the one person who could authorize everything, and without handing one person full power in the meantime.
A custody provider that was supposed to last for decades is acquired, restructured, or wound down. The migration is brutal at small scale and worse at large scale. The family bears the operational risk.
Threats. Social engineering. The phone call at three in the morning that sounds authoritative and urgent. Any single individual with full access is, eventually, the target.
Wealth that is unreachable is, for as long as it is unreachable, absent.
For larger family arrangements, this is run with a live operator on a setup call. The mechanics are the same as the standard product; the difference is the conversation that surrounds them.
Identify what the family office actually depends on. Not every credential in the building, but the small set that, if lost, would take six months to rebuild. That set is the ceremony.
Principal, spouse, adult child, family counsel, family safe. Five holders, threshold three. No single one can act alone; no single departure is a crisis. The structure is tailored to the family, not standardized.
The credentials are encrypted in the browser, the key is split into shares, the shares are produced. The whole ceremony runs once, with an operator on the call, in a single sitting. Server-side, we receive nothing.
People change. Roles change. Holders move, retire, are added. The Annual Review Checklist makes maintenance a calendar entry, not a discovery during a crisis.
Authenticated symmetric encryption. GCM mode detects tampering on recovery. The same cipher used to protect classified material at the highest civilian level.
From Adi Shamir's 1979 paper. Each share is a point on a polynomial over a finite field. K points reconstruct it. Fewer than K reveal zero information about the key.
The person who established the office and historically held the access.
A second principal of equal standing, in a different physical location.
An adult child or named successor, formally part of the recovery quorum.
The attorney who already holds the will. The natural neutral third party.
A sealed copy in the family's safe deposit box or institutional deposit.
Trustees, family-office staff, additional generations — configurable.
Try the cryptography on a throwaway value. No signup. When the conversation calls for an engagement, we set it up directly with the family.
Custom thresholds. Multi-generational holders. White-glove ceremony with a live operator. Bespoke documentation alongside your counsel.
Open a conversation →