Where the keys live — and why they live apart.

One unlocks. One routes.

Where each object lives. Structure, not policy.

The system is designed so a single point of failure cannot defeat it. The records and the WARRANT live at different locations. The Trusted Persons Memo lives with the Trusted Persons, not with you. No one place holds enough to open the whole system.

A break-in at home does not defeat the system.

The records at Location A would tell a thief who you are and what providers you use — but not the master access. The password manager remains locked because the WARRANT is at Location B. Without the WARRANT, the records have value to your family but minimal value to anyone else.

A flood at Location B does not defeat the system. The WARRANT is gone, but the records at Location A continue to function. You re-print the WARRANT; the rest of the system continues uninterrupted.

A lost Trusted Persons Memo does not defeat the system either. The card is a reminder, not a credential — nothing printed on it opens anything, so a stranger who finds one gains nothing and the person you named loses nothing. You re-print a replacement from the portal in a minute.

Both Location A and Location B would have to be defeated separately for the system to fail. The two-location principle is the discipline that makes that very unlikely.

Volume III in your portal has the complete Secure Custody walkthrough — how to actually set up the WARRANT, the recommended sealing process, the timing of the two-location separation, what to print on the Trusted Persons Memo. This page is the concise reference.