Reference Stacks
Current example tool stacks for building the FIRM System — pairings of a cloud service, a notes or wiki tool, and an encryption layer. The Recoverable Family teaches the four implementation models; the specific tools live on this page rather than in print, because a book cannot stay current and this page can. It is reviewed and updated as tools change.
Last reviewed: November 2026. These are examples, not endorsements — judge any stack by the criteria below. Nothing here is sponsored, and there are no affiliate links.
How to choose a stack
- Portable formats first. Plain text, markdown, and PDF outlive any vendor. A stack you can walk away from is a stack you can trust.
- Encryption you control. The Vault's protection should come from a layer whose keys you hold — an encrypted container, an encrypted disk image, or a password manager's database — not only from a vendor's promise.
- Account recovery is the back door. Whatever cloud account anchors the stack can usually be recovered by whoever controls its recovery path — so your strongest authentication and most deliberate recovery setup belong on that account.
- Understand sync before trusting it. Know what leaves your device, where it goes, and whether it is encrypted before it travels. Cloud sync can move files you did not mean to move.
- Start with what your household already uses. The best stack is the one your family will actually maintain — a familiar tool beats an impressive one.
- The Family Guide must open anywhere. Whatever holds the Secure Guide, the Family Guide ends up as something any trusted relative can read without special software — a PDF or a printed binder.
A stack is judged by the criteria, not the logos. Any combination that satisfies them is a sound choice — including combinations this page has never heard of.
One naming collision to be aware of: Obsidian calls each of its notebooks a “vault.” That is Obsidian's word for a folder of notes — it is not the Vault of the FIRM System, which is your encrypted, family-controlled container for secrets. An Obsidian “vault” becomes part of your Vault only when it lives inside encryption you control.
Digital-Centric stacks
In the Digital-Centric Model, the Vault is an encrypted container or protected folder inside a cloud service; the Secure Guide lives inside it as structured notes or files; the Family Guide is a distilled, non-sensitive export stored where the people who need it can reach it. Each stack below is described the same way, so they can be compared.
The floor: a generic cloud drive + encrypted notes
The complete starting stack the book names — the lowest-friction way in. Any mainstream cloud drive, plus simple notes kept inside an encrypted folder (Cryptomator is a common way to add that folder to any drive).
- Where the Vault is: the encrypted folder inside the cloud drive.
- Where the Secure Guide lives: as notes or files inside that encrypted folder.
- How the Family Guide is derived: copy only the non-sensitive summaries — what exists, what it is for, whom to call — into a separate accessible file or printout kept outside the encrypted folder.
- What to watch for: keep the notes inside the encrypted folder, not in the notes app's own cloud; put your strongest authentication on the drive account, because its recovery path is the back door to everything.
iCloud + Apple Notes
Native for Apple-household families — no new tools to learn, and folder structure does the separating.
- Where the Vault is: an encrypted container in iCloud Drive for documents, with Apple's own protections layered on top (locked notes for small secrets; Advanced Data Protection if your family opts in).
- Where the Secure Guide lives: a dedicated Notes folder. Ordinary iCloud notes are encrypted with keys Apple holds, so this folder passes the keys-you-hold test only with Advanced Data Protection turned on; without it, lock each sensitive note or keep the Secure Guide as files inside the encrypted container.
- How the Family Guide is derived: a second folder holding only the family-safe pages, exported to PDF or printed.
- What to watch for: the Apple account is the stack — set up its recovery deliberately (recovery contacts, and a Legacy Contact so the right person can reach the account later; a Legacy Contact receives notes and files but not Keychain passwords, and a locked note still needs its passphrase, so that passphrase lives with the Vault Key, outside the account); note exports are per-note and a little clunky, so derive the Family Guide on a schedule; vendor lock-in is real, so keep periodic PDF exports.
Dropbox + Obsidian
For families who want structure without giving up portability — the Secure Guide is a folder of plain markdown files that any editor can open, on any platform, decades from now.
- Where the Vault is: a Cryptomator-encrypted folder inside Dropbox (Obsidian's notes are plain text on disk — they need an encryption layer before they sync anywhere).
- Where the Secure Guide lives: an Obsidian notebook — its markdown files — inside that encrypted folder.
- How the Family Guide is derived: the family-safe pages are copied or exported to a PDF or printed binder kept in the home.
- What to watch for: the Dropbox account's recovery path guards the whole container; community plugins are code you are trusting — keep the family notebook boring and plugin-light; the markdown portability is the whole point, so resist formats that break it.
A self-hosted wiki (MediaWiki, DokuWiki, or similar) + a cloud drive
For families who want linked, structured knowledge — pages that reference each other the way the information actually connects — and who have a household technologist willing to be its steward.
- Where the Vault is: separate from the wiki — an encrypted container (or password manager) holds the secrets and the wiki's own credentials. The wiki holds structure and knowledge, never passwords.
- Where the Secure Guide lives: as wiki pages, backed up encrypted to the cloud drive.
- How the Family Guide is derived: a marked set of family-safe pages, exported to PDF on a schedule.
- What to watch for: a wiki has a maintenance cost — unpatched software becomes a liability, and this stack is only as durable as its steward; plan the off-ramp now: regular plain exports a non-technical heir can use if the wiki ever goes dark.
The Hybrid stack — the book's worked example
Obsidian in a Cryptomator vault + a printed Family Guide binder
The Hybrid Model as the book describes it: digital convenience with a hard wall around the secrets, and a Family Guide that works with the power out.
- Where the Vault is: the Cryptomator-encrypted vault holding the notebook.
- Where the Secure Guide lives: a structured Obsidian notebook — portable markdown files — inside that encrypted vault.
- How the Family Guide is derived: each section keeps a secure page and a family page; only the family pages are copied into the accessible file or printed binder kept in the home.
- What to watch for: some applications push aggressive cloud sync, and a notebook stored over its vendor's cloud can upload unencrypted content if file locations and sync settings are not watched — understand the difference between your encrypted container and the application's own cloud behavior. There is no one-click “export only family-safe content” anywhere; the secure-page/family-page discipline is what makes the split reliable.
The Minimalist technical variant
KeePass + HTML export
Proof that a disciplined password manager can be stretched into a Secure Guide. KeePass keeps its database as a single encrypted file you control completely — no account, no vendor cloud.
- Where the Vault is: the KeePass database file itself (plus wherever its backups live).
- Where the Secure Guide lives: inside the database, as entries with a clean, consistent field schema — the discipline is what makes this work.
- How the Family Guide is derived: a structured export of only the non-sensitive fields to a simple HTML page or a printed sheet.
- What to watch for: one file means one point of failure — give the database the same backup redundancy as anything else in your Vault; re-run the export whenever entries change, or the Family Guide quietly drifts out of date; KeePass's HTML export includes passwords unless you untick the Password field in its Fields list, so open the file and check it before it leaves the database.
No stack at all
The fully analog Minimalist Model — two physical journals, the Secure Guide in a fire safe or safe-deposit box and the Family Guide accessible in the home — needs nothing from this page, and the book covers it completely. The Professional-Partnered Model is a posture rather than a toolset: get the information in order first, with any of the stacks above or none of them, then bring organized inputs to the professional. The questions to bring are printed in the book.
If this page and the book ever disagree about a specific tool, this page is the newer word — that is its job. What never changes is the architecture the tools serve: Vault → Secure Guide → Family Guide — secrets, understanding, sharing.