Legatus encrypts your credentials, documents and final messages in your own browser. Your nominees receive them only after two of three independently confirm your death, an administrator reviews a death certificate, and a 72-hour hold elapses.
Inheritance law decides who owns your accounts. It does not hand anyone your passphrase. A family can hold a succession certificate for a crypto wallet and still be unable to open it — ownership is a legal question, access is a cryptographic one.
Passwords, recovery codes, and the accounts nobody else knows exist.
Seed phrases and wallet access, without writing them into a will.
Policies, deeds and the paperwork an executor will need to find.
Letters written once, delivered only after a verified transition.
Final wishes and instructions, held against the day they are needed.
Most dead man’s switches release on a timer alone. Legatus uses check-ins only to raise an alert, and requires people and documents before anything opens.
Encrypted in the owner’s browser. Legatus never receives the passphrase.
The vault key is wrapped separately for each of three nominees.
Two nominees must confirm the death independently. One cannot.
An administrator reviews an uploaded death certificate.
A mandatory delay in which a wrong release can still be stopped.
You choose a master passphrase. It encrypts everything, and Legatus never receives it — the key is derived in your browser with PBKDF2 at 310,000 iterations and the vault is sealed with AES-256-GCM.
You appoint an Executor, a Witness and a Beneficiary. Each generates an RSA-2048 key pair, and your vault key is encrypted separately for each of them. No nominee can read your vault alone.
At an interval you choose — monthly, bi-monthly or quarterly — you confirm your presence with a single action. A missed check-in alerts your nominees rather than releasing anything.
Release requires two of your three nominees to confirm independently, a death certificate reviewed by an administrator, and a 72-hour hold. Any one of the three acting alone cannot open the vault.
Your messages are dispatched and your credentials, documents and directives are released to each nominee according to the role you assigned them — nothing more.
Legatus is built for hostile conditions. A breach of the Legatus server exposes ciphertext and nothing else.
CREATE YOUR VAULTThe server stores only ciphertext. Decryption happens exclusively in your browser during an active session.
If you lose your passphrase, your vault contents are permanently unrecoverable. That is a design decision, not a gap — a recovery path Legatus could use is a recovery path an attacker could use.
After 30 minutes of inactivity your decrypted vault key is wiped from memory. Re-entry requires only your passphrase.
Death certificates live in a private bucket. Signed URLs expire in 15 minutes, and only administrators can generate them.
Legatus cannot tell a passphrase given freely from one given under duress. Two colluding nominees are its weakest point.
READ THE FULL THREAT MODEL