Security › Sealed-message custody

Custody · the second custodian

Your sealed messages are copied to an independent archive.

The day your family needs a sealed message may be decades from the day you record it.

So the moment you seal one, a copy deposits into a separate independent archive — held with a different provider, on a different account — that the credentials our systems use can add to but cannot delete from.

Not a policy. A permission.

Deposit-on-seal live · reconciled daily · proven by drill monthly

§1Why this exists

A message meant for the worst day cannot live in one place.

A sealed message is the most irreplaceable thing anyone stores with us. It cannot be re-created, re-scanned, or asked for again. Everything else Valoren holds — records, registers, prepared documents — can be rebuilt from life if it had to be. A letter from someone who has died cannot.

So sealed messages do not share their fate with our main infrastructure. Every one is deposited into an independent archive on a different storage provider, under a different account, with different billing — a second custodian whose availability does not depend on ours.

This page documents how that works — the trigger, the permissions, the daily reconciliation, and the monthly proof — because a custody claim you cannot inspect is just marketing. We document our mechanism. We think everyone in this category should.

The broader system

A sealed message is one part of a larger record.

This page documents how one specific asset is kept safe. Valoren's estate planning system covers everything else your family will need — records, contacts, instructions — held current until the day they're needed.

Continuity layer

What this becomes inside Valoren

Stored in your records system

The information you've just shared lives in your Valoren records — encrypted, organised, ready when you or your trusted person needs it.

This page is one part of a larger system.

A document decides what happens once. Valoren's 33 records cover everything your executor needs to actually act — held current, visible to the people who need them.

Kept current for you

Tax thresholds change. Pension rules change. Family circumstances change.

Your records system updates the relevant outputs when they do — no need to redo this.

Surfaced when it matters

The right document for the right moment. Day-one of a bereavement. A capacity event. An executor's first hour.

The system already knows what to produce.

Visible to the people who need it

Your trusted person sees what you've chosen to share, when you've chosen to share it.

No password handover. No "where are the documents." A real continuity layer above your will.

Find this again

We'll email you a link back to this page — no need to search for it later.

Most people start with The Household Continuity Dossier — 14-day full refund, cancel any time in two clicks.

See full pricing and what each tier includes 14-day full refund · two-click cancel · your records always leave with you →

Practical guide, not legal advice. Prepared 24 August 2026. ES-2026.

§2How it works

Seal. Deposit. Reconcile. Prove.

ISeal

You seal a message

A letter, a recording, an enclosure — sealed in your portal for delivery at the moment you chose. From this point it is treated as correspondence in custody, not as ordinary account data.

IIDeposit

A second copy deposits automatically

Sealing triggers an immediate deposit into an independent archive — a different storage provider, a different account, different billing, from everything else we run. The message shows a pending state until that deposit is confirmed.

IIIReconcile

A daily sweep re-checks everything

Every day, everything sealed is checked against everything deposited. A deposit that failed stays visibly pending and is retried — the system is built so that a weaker-custody interval can never pass silently.

IVProve

A monthly drill proves it still opens

Once a month, sealed items are opened exactly the way a real delivery would open them. Custody you cannot periodically prove is a promise, not a mechanism — so we prove it, permanently.

From reading to ready

This guide is free, and it stays free. The Household Continuity Dossier renders your household's own version — your people, your accounts, your wishes — into a maintained record your executor or trusted person will actually reach for, kept current every year.

See The Household Continuity Dossier

§3The permission model

Our systems can add to the archive. They cannot delete from it.

The credentials our systems hold for the second archive are write-only. They can deposit new bundles and list what exists. They cannot delete stored versions, and that restriction is enforced by the storage provider's own permission system — not by our code, our configuration, or our good intentions.

That distinction matters. A promise enforced by our code fails when our code fails. A permission enforced by an independent provider holds through our bugs, our bad deploys, and anyone misusing our systems — because the capability to delete simply is not there to misuse.

We choose our words on this page carefully — you will notice we say what the credentials cannot do, not what no human could ever do. That precision is deliberate: every claim here is scoped to what the mechanism actually proves.

§4Built to be checked

Every bundle verifies itself. Every month proves the path.

Each deposit is content-addressed: its name is derived from the cryptographic fingerprint of its own contents. Change a single byte — of the message, the manifest, or the README — and the alteration is detectable by anyone, with no trust in us required.

Alongside the sealed payload, every bundle carries a plain-English README addressed to whoever finds it — an administrator, executor, or escrow agent — written on the assumption that nobody from Valoren is there to explain it.

And once a month, a drill opens sealed items exactly the way a real delivery would, end to end. Like the verified figures on our figures pages, the point is the same: a promise you re-prove on a schedule is a different kind of promise.

FAQ

Custody questions, answered.

Every sealed message, in full. The letter text itself, any recorded audio or video, and every enclosure each become a sealed bundle — the payload, a manifest, and a plain-English README explaining what the bundle is and how to open it.

This includes text-only letters with no attachments. A sealed letter is not a file sitting in storage — it is written content — and it is deposited with exactly the same care as recorded media.

A second archive copy is stored in readable form rather than encrypted with a key held only by Valoren. That avoids making Valoren's own systems the only route by which the archived correspondence could later be recovered.

At the moment of sealing. Sealing a message triggers the deposit automatically, and the message carries a visible pending state until the deposit is confirmed.

A daily reconciliation sweep then re-checks everything sealed against everything deposited, permanently, as the recovery floor behind the trigger — not the ordinary deposit mechanism. A failed deposit stays visibly pending and is retried — it is never silently marked as done.

The credentials our systems use for the second archive can add to it and list what is there — they cannot delete stored versions. That restriction is enforced by the storage provider's permission system, not by our code, which means no bug, no compromised deploy, and no employee using those credentials can remove what has been deposited.

We say precisely this, rather than something grander, because it is the claim the mechanism actually proves.

Two ways, both mechanical. Every bundle is content-addressed — its name is derived from the cryptographic fingerprint of its own contents, so any alteration anywhere is detectable by recomputing the fingerprint.

And a monthly drill opens sealed items exactly the way a real delivery would, proving the path end to end — not once at launch, but every month, permanently.

The archive is held with a different storage provider, on a different account, with different billing, from everything else we run — it does not depend on our infrastructure staying up.

Every bundle carries a plain-English README addressed to whoever finds it — an administrator, executor, or escrow agent — written on the assumption that Valoren is no longer operating and nobody from Valoren is there to explain it. Your sealed messages are documented well enough to outlive us.

Read alongside our security promises — custody of sealed messages is promise IX.