Holdfast Co

Holdfast Co is a zero-knowledge digital estate vault and dead man's switch service operated by Nexus-Sectech Ltd, a UK-registered company. It helps people leave their digital lives in order for the people they trust, without the operator ever being able to read what is inside the vault.

A vault stored with Holdfast Co holds credentials, signposting information, documents, and private video messages, all encrypted in the browser before they reach the server using AES-256-GCM. The encryption key is derived from a passphrase that never leaves the user's device, so vault contents cannot be read even with full access to the database.

When a user nominates recipients and stops checking in, an escalation sequence runs over roughly two weeks. If no check-in arrives, the encrypted vault is delivered to the nominated recipients with the instructions they need to decrypt it, using a passphrase the vault owner shared with them offline during their lifetime. Recipients do not need a Holdfast Co account, an app, or any prior setup.

Holdfast Co is operated under UK GDPR, which the EU recognises as providing an equivalent level of protection under its adequacy decision. Nexus-Sectech Ltd is registered with the Information Commissioner's Office (ZC120755) and Companies House (17126982). Users worldwide are welcome and data is processed to UK and EU standards regardless of where the user is based.

The encryption module is open source with Subresource Integrity enforcement at github.com/Nexus-sectech/holdfast-crypto. A Firm tier is available for professional firms in legal and financial services who want to offer digital legacy planning as part of their client service.

Full diligence documentation, including 80+ answered questions on architecture, security, and operational commitments, is at holdfast-co.uk/diligence.