Zero-knowledge is safe.
Until the user forgets.
End-to-end encryption protects users from providers. But it doesn't protect them from themselves — a lost password, a broken phone, or a sudden loss in the family, and the vault is gone forever.
One key, split by math.
Reassembled by identity.
ProntoID Recovery uses Shamir's Secret Sharing to split the user's encryption key into fragments. Each fragment lives behind a different challenge. The key only exists when the user can prove themselves.
Service generates key
The provider (e.g. PostaVoice) creates a strong random encryption key on the user's device. The key encrypts the user's data client-side. The provider never sees it.
Recovery splits & gates
The key is split into N fragments on the device. Each fragment is stored behind an independent challenge — passkey, live face match against the verified ID, passphrase, authenticator, trusted contact.
User recovers anywhere
On any device, the user completes K of N challenges. ProntoID reassembles the key locally and hands it back to the provider's client. The vault opens.
For everyday access.
And for when you're gone.
Personal challenges
The everyday case. Forgot your password, switched devices, or logging in from the browser for the first time. Fragments are gated by things only you can satisfy — including your own face, matched live against your verified ID.
Trusted humans
The extraordinary case. When you cannot prove yourself — illness, death, or incapacity — a threshold of ProntoID-verified people you chose can unlock the vault together, each passing a live face match first.
Both tiers are cryptographically independent. Compromising one doesn't touch the other. Users configure thresholds (e.g. 3 of 5) that match their own risk tolerance — and can reconfigure as life changes.
From prototype
to platform
ProntoID Recovery is a new product in the ProntoID family. Here's how it ships — and what we're building toward.
Foundations
Core Shamir Secret Sharing engine. Fragment storage. Challenge framework (passkey, face match against verified ID, passphrase, authenticator). Rate limiting and abuse detection. Public technical documentation and third-party cryptographic audit.
First integrations · PostaVoice & ProntoVault
Flagship deployments: PostaVoice voice notes and ProntoVault, our face-locked personal vault, both under client-side encryption with ProntoID Recovery for recovery. Real users. Real stakes. Learnings that feed the platform.
Trusted contacts
Tier 2 legacy recovery ships. Users designate ProntoID-verified trustees and configure thresholds; trustees pass a live face match before their fragment is released. Coordinated recovery UX, cooling-off periods, and audit logs.
Developer API & SDK
General availability for third-party services. RESTful API, drop-in SDKs for web and mobile, sandbox environment, and clear pricing. Any service with a user-held key can integrate ProntoID Recovery in hours.
Knowledge challenges
Rich personal challenges as recovery gates — photo recognition, memory prompts, custom questions — always as gates in front of real keys, never as keys themselves. Enrolment UX designed to keep answers genuinely private.
Digital inheritance framework
Legal-grade post-mortem access. Jurisdiction-aware executor flows. Integration with estate-planning tools. Making cryptographic inheritance fit the laws it needs to operate under.
Open custodianship protocol
An open, auditable protocol for identity-backed key custody. Not a walled garden — a foundation other identity providers can adopt. The long-term goal: a shared standard for how humans recover what encryption protects.
Any service where
the user holds the key
Memory & legacy
Voice archives, family photo vaults, digital diaries. Content that must outlive the password, and often the owner.
Personal vaults
Face-locked file vaults like ProntoVault — lose every device and still get back in by passing enough of your challenges.
Password managers
Give users a recovery path that doesn't rely on a printed sheet they lost six years ago.
Medical & legal records
Sensitive documents encrypted client-side, recoverable by the patient — or by next of kin under the right conditions.
Crypto & financial self-custody
Non-custodial wallets that finally have human-grade recovery. Lose the seed phrase? Recover through identity.
Shared family vaults
Family-owned encrypted archives with threshold access — no single parent's forgotten password can lock everyone out.
Cryptography we didn't invent.
Discipline we insist on.
ProntoID Recovery uses no novel cryptography. Every primitive is well established, peer-reviewed, and already deployed in production security systems. Our job is to make it usable — not to outsmart the mathematicians.
Common questions
Does ProntoID ever hold a usable copy of the key?
No. The key is created and used on the user's device. Fewer fragments than the threshold reveal nothing about the key, and every recovery setup is built so that the fragments ProntoID can release on its own stay below the threshold — the rest are sealed to things only the user or their trustees hold, such as a device passkey or a passphrase. The key is reassembled on the user's device only after enough challenges are passed.
Where does face match come in?
A live face match against the user's verified ProntoID is one of the strongest gates available: it proves the person recovering is the person who verified, not just someone holding their phone number. It unlocks one fragment, like every other gate, and is always combined with others to reach the threshold.
What happens if one challenge is weak?
A challenge unlocks one fragment, not the vault. Recovery needs several independent successes, every challenge is rate-limited, and every recovery attempt is notified, delayed and logged.
Can someone recover my vault after I die?
That is the purpose of the legacy tier: a threshold of ProntoID-verified people you chose in advance can recover access together, after a cooling-off period. Jurisdiction-aware executor flows are on the roadmap.
Is ProntoID Recovery available now?
Not generally. ProntoID Recovery is in development with a small number of design partners, and it powers recovery in ProntoVault, our own face-locked personal vault. Join the waitlist to be considered.
Building something that
needs real recovery?
We're partnering with a small number of design-partner services ahead of general availability. Tell us what you're building, and we'll see if ProntoID Recovery fits.
Design partners get early access · Direct line to engineering · Influence the roadmap