The Encryption Module
The encryption you rely on — full-disk, encrypted containers, hardware-level encryption — one entry per method, carrying the instructions your future self or an heir needs to decrypt.
Where this Module fits
S-04 Module 4 of 6 in the System area — step 1 of 4 on the dependency ladder (System → At-Home → Financial → Estate).
Fourth — locks the contents; every other module assumes The Secure Guide is protected, and this is what makes that true.
Adds to The Secure Guide: One entry per encryption method or tool — how to decrypt, key location by reference, recovery status.
Adds to The Family Guide: That encrypted storage exists, the pointer pattern, and “do not guess passwords”.
Every Module adds one section to each guide — that is how the two guides assemble as you work. See what you're building.
Text file — the flexible one. Use it as-is, paste it into a spreadsheet, open it in any editor, or paste it into an AI tool to reshape the blank form to fit your family: rename a field, add a row, drop one you don't need.
Print / PDF — the ready-to-use one. Print it and fill it in by hand, or choose Save as PDF and complete it in your own offline PDF app. Either way it stays with you — the finished Secure Guide template goes inside your Vault.
One rule: only ever give an AI tool the blank template. Never paste your real information — passwords, account numbers, anything you'd keep secret — into an AI tool, an online service, or anywhere outside your own Vault. Customizing an empty form is fine; filling it in happens privately, offline. That's the same rule this site follows: nothing sensitive ever leaves your hands.
Secure Guide Starter Template — Encryption
One Secure Guide entry per encryption method or tool — never per file or container. Files and containers are documented in their own Modules and marked “encrypted with <method> — see the Encryption Module”; this section holds the other half: how each method is opened by someone who is not you. Link to credentials in your password manager rather than recording them here.
Encryption sounds technical, but most of the protection is already built into your devices — the work is turning it on and keeping the keys findable by the right people. And remember: in practice, no one breaks good encryption — they talk someone out of the key. No legitimate process ever needs a passphrase or recovery key read over a phone or typed into a link; anyone asking, however convincing, is the attack. The keys themselves live in the password manager or physical Vault — never in this record, and never inside the container they open.
Family Guide Starter Template — Encryption
This template contains no sensitive information. It can be stored with household documents.
In the matching Secure Guide section: one entry per encryption method or tool — how to decrypt, key location by reference, recovery status.
That detail is what makes recovery possible — and it is protected in the Vault, which opens with The Vault Key. The key is never written here, by design. The people listed on this page know how it is kept, and the steward's job is to keep that path current, so this page never leads to a locked door.
Anything this page's reader should know that the sections above didn't ask for — the exceptions, the house quirks, the thing you would say out loud while handing this page over.
For more information on how to use these templates, see The Recoverable Family book.
Worked example — Frank's family
Frank's encryption comes down to three METHODS, and that's how his entries are organized — one per method, never per file. Anything encrypted elsewhere in the system is marked with its method — “VeraCrypt — see Encryption” — and this section answers the other half: how each method opens, written for whoever has to do it without him. The rule holding it together never varies — the key never lives inside the container it opens.
All details are fictional and illustrative. The assembled example guides live at the example Secure Guide and the example Family Guide.
Secure Guide — Frank's entry
One entry per encryption method. Keys are referenced by location only; the files themselves are documented in their own Modules.
Entry 1 — VeraCrypt (encrypted containers)
Entry 2 — BitLocker (built into Windows)
Entry 3 — FileVault (built into macOS)
Default device encryption on the family phones rides the Devices inventory — the phones' own rows note it. Which files use which method is marked on the files' entries in their own Modules; this section only ever answers “how does that method open.”
Family Guide — Frank's entry
This entry sits in the household reference binder. It contains no keys and no tool names a stranger could act on.