How My Signal Vault works: timers, encryption and delivery

This is the technical tour: what My Signal Vault does, how each part works, and where the limits are. No marketing adjectives. If you are still deciding whether a dead man’s switch is the right idea at all, start with what a dead man’s switch actually is and come back.

The shape of it

You create a vault. A vault holds a written message, one recipient’s email address, any files you attach, and a check in interval. You arm it, and a countdown starts. Pressing Check in resets the countdown to full. If the countdown ever reaches zero, your message and its attachments are emailed to that one recipient, and the vault is finished.

Everything else in this article is detail underneath that.

The timer

Intervals run from one hour to thirty days. Presets are 1 hour, 6 hours, 12 hours, 1 day, 2 days, 3 days, 1 week, 2 weeks and 30 days; Pro and Lifetime accounts can set any value in the range, so a 10 or 21 day timer is available if that fits your life better.

Two warnings go out on every armed vault: at 75 percent of the interval and again at 90 percent. On a 30 day vault that is roughly day 22 and day 27. They are sent by email, and by push notification if you have installed the app on your phone. Each is sent once per countdown, and checking in resets both along with the clock.

A vault can be paused at any time. A paused vault has no clock, sends no reminders, and cannot deliver. This is the correct thing to do before a flight, a hospital stay, or anywhere you know you will be unreachable — considerably safer than hoping to find signal. Arming it again restarts the countdown from the full interval.

Editing the interval on a live vault moves the deadline with it, measured from your last check in. Lengthening is always safe. Shortening pulls the deadline closer, and the vault screen shows you the new deadline immediately, which is worth reading before you close the tab.

Delivery

When a deadline passes, the scheduler picks the vault up within about five minutes. It claims the vault and marks it as triggered before sending anything, so a slow send can never become a duplicate send. Attached files are fetched from storage and decrypted in memory. One email is composed — your message as the body, your files as attachments — and handed to the delivery provider. You are then emailed to say it happened, and the event is written to your audit log.

A delivered vault is final. It cannot be armed, reset or re-sent. It stays visible in your account as a record of what went and when.

The attachment ceiling is about 9MB in total, because that is what mail providers will accept. If a vault holds more, the largest files are dropped rather than the whole email failing. This is the single most important practical limit in the product: a vault should carry instructions and documents, and point to bulk material rather than trying to deliver it.

Your recipient needs nothing. No account, no app, no password, no link to click before it expires. If they can read an email, they can read what you sent. They are also told nothing in advance — not when you create the vault, not when you arm it, not when you edit it. The first they hear is the delivery itself.

Encryption

Files are encrypted with AES-256-GCM. Every file is given its own randomly generated key, and that key is itself encrypted with a key derived for your account before being stored alongside the file record. This is standard envelope encryption: the key that opens your file is never stored anywhere in a usable form.

Encryption happens block by block as the file uploads, with each block carrying its own authentication tag. Two things follow. Memory stays bounded, so a 2GB file costs no more memory than a 2MB one. And tampering is detected on read rather than producing quietly corrupted output.

The complete set of block tags is fingerprinted and stored with the file record, and that fingerprint is verified during decryption. This is what catches truncation: an attacker who strips whole blocks off the end of a stored object cannot make the result look intact.

Everything travels over TLS, with HSTS set so browsers refuse to fall back to an unencrypted connection.

The honest limitation

Decryption happens on our server, at the moment you download a file or a vault delivers one. This is not zero knowledge encryption and we will not describe it as if it were.

What it does protect against is every realistic attack on data at rest: someone obtaining the storage bucket, a leaked or stolen backup, a misconfigured server, the storage provider’s own staff. In all of those cases what exists is ciphertext without usable keys.

What it does not give you is a mathematical guarantee against the operator. No service that can email an attachment to a recipient with no account and no key can give you that, because something has to hold the key. If your threat model requires it, encrypt the file yourself before uploading and pass the passphrase to your recipient by another route — the vault will deliver it exactly the same way, and we could not read it under any circumstances.

Files

Files live in your Files area independently of any vault, so one file can be attached to several vaults without being stored or counted twice. Uploads are sent in 5MB pieces, which keeps a dropped connection from costing you the whole file, and up to ten uploads can be open at once.

Storage is 100MB on Free, 1GB on Basic, and 10GB on Pro and Lifetime, measured across all your files. There is no separate per-file cap. Your quota counts bytes already sent for uploads still in progress as well as files stored, so several simultaneous uploads cannot slip past the limit between them.

Executable and script types are refused — exe, bat, sh, js, php and the rest of that family — because a file store that accepts them becomes a place to host malware. Put the file in a zip and it uploads without complaint.

On Pro and Lifetime, a file can be given a self destruct timer from five minutes to one year. When it expires the object is deleted from storage, the record goes with it, and the destruction is logged. Worth checking that date against any vault the file is attached to.

Account security

Two factor authentication uses standard TOTP, so any authenticator app works — Google Authenticator, Authy, 1Password, Bitwarden, whatever you already have. A set of one-time backup codes is issued when you enable it, shown once, and stored only as hashes. Disabling two factor requires both your password and a current code, so a stolen session cannot strip the protection off the account.

Failed sign ins are counted per address: three failures in a row locks that address out for 20 minutes, and three more after that locks it for 24 hours. A successful sign in clears the count, and so does a full day with no failures. Sensitive endpoints carry their own rate limits on top of that.

Changing your password signs out every other session immediately and invalidates every issued token. There is also an explicit sign-out-everywhere control under Security.

It is worth being clear about what the actual risk is here. Somebody who gets into your account is unlikely to care about reading your message. What they can do is quietly pause your vaults, so that they never send and nothing looks wrong. Two factor authentication removes that risk almost entirely, and it takes about two minutes to set up.

The audit log

Every action on the account is recorded with its time and the address it came from: sign ins, failed sign ins, check ins, vault changes, uploads, downloads, security changes, billing events. You can filter by category or by a single event type, search the detail and the address, narrow to a date range, and export the filtered set as CSV.

Times are rendered in the timezone set on your profile rather than the timezone of whatever device you are reading from, so the log reads the same from a hotel laptop in another country. Entries worth a second look — a failed sign in, a password change, two factor being disabled, a vault being paused — are highlighted.

Plans

All prices in US dollars. Every plan uses the same encryption, the same delivery machinery and the same audit log. What changes is how much you can store and how many vaults can be armed at once.

• Free — $0. 100MB, one armed vault. Not a trial: no card, no expiry, no nagging.
• Basic — $10/month or $96/year. 1GB, five armed vaults, priority support.
• Pro — $15/month or $144/year. 10GB, unlimited armed vaults, self destructing files, custom intervals.
• Lifetime — $179 once. Everything in Pro, permanently, with no recurring payment.

Only armed vaults count against the limit, so you can keep as many paused drafts as you like on any plan. Upgrades apply immediately and are prorated; downgrades apply at the end of the period you have paid for. Nothing is ever deleted when a plan drops — but armed vaults over the new limit cannot stay armed, which is the one consequence worth planning for in advance. Any payment is refunded in full if you write to us within 30 days, for any reason or none.

Deleting everything

You can erase the account yourself, from your profile, by typing DELETE and entering your password. It cancels any subscription first — so deletion can never leave you paying for something that no longer exists — then removes every vault, every file and its keys, any upload in progress, your entire audit history, your profile, your two factor secret, and every session.

One anonymous line stays in our security records: that an erasure happened, when, and how many vaults and files it covered. It contains no name and no address; the reference on it is a one-way hash, which can confirm a specific address only if that person supplies it themselves. It is irreversible, and it is deliberately not a button you can press by accident.

What it is not

Three things, stated plainly.

It is not an emergency service. If your interval is a month and something happens on day two, nothing is sent for four more weeks. For anything needing a response in minutes, you want a person with your phone number.

It is not a will. Delivering instructions to a named person gives them no legal authority. Use it to make a will easy to act on, not to replace one.

It is not zero knowledge. Covered above, and repeated here because it is the thing most likely to matter to the kind of person who reads this far.

Trying it

The free plan is one vault and 100MB with no card, which is enough for a letter and the documents that go with it. If you would rather read before signing up, the help centre covers every part of this in more depth, and our guide to choosing a service lists the questions worth asking of anyone in this category, us included.