Skip to main content
If someone you trust has invited you to be a Guardian for their Inheribase vault, you do not need to be a technical expert to fulfill this responsibility. Your role is straightforward: hold a piece of an encrypted puzzle and contribute it when an authorized recovery is requested. This guide walks you through everything you need to know.
Never forward your Guardian invitation email or any Recovery Request emails you receive. Your key share is cryptographically bound to your identity alone, and forwarding these messages will not transfer your Guardian role — it will only expose sensitive metadata.
1

What is a Guardian?

Inheribase stores a vault owner’s data in a form that no one — not even Inheribase engineers — can unlock. Instead of relying on a single master password that could be stolen or forgotten, the owner’s master key is mathematically split into multiple fragments using a technique called Shamir’s Secret Sharing.As a Guardian, you hold one of these encrypted fragments. The fragment is inactive on its own. Only when enough Guardians (for example, 2 out of 3) submit their fragments simultaneously can the vault be reassembled and handed to the designated heirs.You never see the vault’s contents. You have no access to the owner’s files, accounts, or finances. You are custodian of a single cryptographic piece — nothing more.
2

What the invitation looks like

You will receive an official email from security@inheribase.com stating that someone has designated you as a Guardian. Look for these three elements:
  1. The vault owner’s name: The email clearly displays who nominated you.
  2. A secure, time-sensitive link: This link routes you to app.inheribase.com to accept your role.
  3. No fees or payments: Guardians are non-paying users. The vault owner has already prepaid everything. You will never be asked to pay to hold a key share or approve a recovery.
If you receive an email that does not match this description — or that asks you to pay anything — do not click any links and contact support@inheribase.com immediately.
3

How to accept your role

Accepting your Guardian role takes only a few minutes and requires nothing beyond a modern web browser.
  1. Click Accept Invitation in the email. You will be routed to a secure page at app.inheribase.com.
  2. Create a free Guardian identity using your email address and a Passkey (Face ID, Touch ID, Windows Hello, or a device PIN). No password is required.
  3. Your encrypted key fragment is immediately bound to the Passkey you just created. Inheribase cannot read your key share — it is encrypted against your biometric anchor.
By accepting, you agree to two things: keep your Inheribase login credentials (your Passkey and recovery codes) safe, and respond promptly if a legitimate recovery request arrives.
4

How to approve a recovery request

If the vault owner passes away or loses complete access to their account, a recovery event will be triggered. Here is what happens next:
  1. You will receive an Urgent Recovery Notification by email from security@inheribase.com.
  2. Click the secure link in the email, which takes you to app.inheribase.com/recovery.
  3. Log in using your Passkey.
  4. Review the details of the recovery request — including who initiated it — to confirm the request is legitimate.
  5. Click Approve Recovery. Your browser securely decrypts your key share and submits it to the recovery smart contract.
Once enough Guardians have approved (for example, you and one other Guardian in a 2-of-3 configuration), the vault is unlocked and the heirs are granted access. You will receive a confirmation email when the threshold is reached.
5

What happens if you lose your key share?

Because Inheribase uses a threshold system — such as 2-of-3 or 3-of-5 — losing your single key share does not permanently lock the vault. The heirs can still reassemble it using the remaining Guardians.However, if you lose both your device and your emergency recovery codes:
  • You will lose access to your Guardian dashboard and will be unable to approve future recovery requests.
  • You should notify the vault owner immediately so they can revoke your current key share and either re-invite you after you set up a new device or replace you with another trusted person.
If you still have your recovery codes, follow the Device Recovery guide to restore access on a new device.

​
FAQ for Guardians

No. You do not have access to the vault owner’s encrypted files, accounts, or finances at any point. You hold an inactive cryptographic fragment — a single piece of a mathematical puzzle. Your only function is to contribute that fragment when an authorized recovery is triggered.
No. After the initial invitation, you will only hear from Inheribase in two situations: if a recovery request is triggered, or if the vault owner updates your Guardian status (for example, revoking and re-inviting you after a device change).
No. All Guardian actions — accepting your invitation, logging in, and approving recovery requests — take place entirely within your standard web browser at app.inheribase.com. No native app, browser extension, or software installation is required.