> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inheribase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Guardians: Distributed Key Protection for Your Vault

> Understand how Inheribase uses Shamir's Secret Sharing to split your vault key across trusted contacts, eliminating any single point of failure.

Your vault key is the single artifact that can decrypt your files. Storing it in one place creates a single point of failure — one lost password, one deceased contact, one compromised account, and your estate is gone. Inheribase eliminates this risk by splitting your key across multiple trusted contacts called **Guardians**, using **Shamir's Secret Sharing (SSS)**. This page explains how the threshold model works, what guardians are expected to do, and how to choose and manage them.

## How the threshold works

Shamir's Secret Sharing splits your vault key into multiple mathematical fragments called **shares**. Any single share reveals zero information about the original key on its own — the key can only be reconstructed when a minimum number of shares are combined.

Inheribase offers two security presets:

| Preset                | Total guardians | Threshold            | Recommended for    |
| --------------------- | --------------- | -------------------- | ------------------ |
| **Standard (2-of-3)** | 3 guardians     | Any 2 must cooperate | Most users         |
| **Enhanced (3-of-5)** | 5 guardians     | Any 3 must cooperate | High-value estates |

If one guardian becomes unreachable — lost email, relocated, or deceased — the remaining guardians can still reconstruct the key. The threshold guarantees resilience without sacrificing security.

## The guardian's role

Guardians are not technical operators. They need nothing more than a valid email address and a modern web browser. They serve three functions:

1. **Vault recovery.** If you lose access to your passkey, your guardians can help reconstruct your vault key so you can regain access.
2. **Release authorization.** If configured, guardians initiate the succession release by confirming the event and contributing their key shares.
3. **Passive protection.** During your lifetime, shares remain dormant. Guardians take no action until either a recovery or release event occurs.

<Note>
  **Silent Directives:** Tell your guardians that you have appointed them. They will receive an email invitation to accept their role, but they will never see your vault contents or know who your heirs are.
</Note>

## Who to choose

Select guardians who are reliable, geographically distributed, and likely to remain reachable over the long term.

**Ideal guardian choices:**

* A trusted attorney, notary, or financial advisor (institutional reliability)
* Family members in different geographic locations (geographic diversity)
* Close friends with stable, long-term email access

<Tip>
  Apply the **diversity principle**: never choose guardians who could all become unreachable simultaneously. For example, avoid appointing guardians who all live in the same city or work at the same company.
</Tip>

## Managing guardians

While your vault is `active`, you can add, remove, or replace guardians at any time.

<Steps>
  <Step title="Navigate to guardians">
    Open your dashboard and go to **People → Guardians**.
  </Step>

  <Step title="Add a guardian">
    Click **Add Guardian** to open the invitation form.
  </Step>

  <Step title="Enter their details">
    Enter the guardian's name and email address, then send the invitation. The guardian receives an email prompting them to accept their role.
  </Step>
</Steps>

<Warning>
  Changing your guardian set — by adding, removing, or replacing any guardian — regenerates **all** key shares. All previously distributed shares are immediately rendered invalid. Your new guardians must accept their invitations for the vault to return to a fully protected state.
</Warning>