An encrypted vault that puts a life's affairs in order, then releases them to the right people.
ARC Legacy is a new South African company with one product: a vault that lets people put their affairs in order during their lifetime and delivers them, verified, to the right people afterward. We came in at the specification stage and are building the entire platform, from the onboarding flow to the operator console.
Visit arclegacy.lifeComing soon
- Industry
- Legacy planning
- Engagement
- Spec, design and full build
- Delivery
- Web app + installable PWA
- Status
- In final testing, launching 2026
A vault that must stay shut, then open on cue.
The product's whole promise is a contradiction to engineer: documents nobody can read while the owner is alive, released to exactly the right people when a verified event says so.
- Everything in the vault has to be unreadable to nominees and operators alike until a release event is verified.
- A reported death, two nominees asking together, an executor's instruction or a check-in nobody answers each has to open a case, and a person has to review every one before anything is released.
- A death claim can't be taken on trust: it has to be corroborated against the Home Affairs register before a single document moves.
- Identity has to be verified at sign-up against South African records, with a manual-review path when the automated check can't make a match.
- A cancelled subscription and a deceased user look identical to a billing system. Getting that wrong would destroy a vault at exactly the moment it matters.
- POPIA had to be a build deliverable, not an afterthought: consent capture, data-subject export, right to deletion, retention rules and an audit trail that proves what happened.
- An independent firm will penetration-test the application before launch, so every security decision had to be deliberate and written down.
Sealed by default, released by rule.
One platform covers the owner's journey, the nominees' access and the operators' console, with the security model designed in from the first migration rather than bolted on.
Verified onboarding
Consent-first sign-up, payment, then a short guided flow: legal details, identity verification against a South African bureau, a first nominee and key contacts. A derived checklist tracks real progress, and a failed check routes to an operator review queue instead of a dead end.
Envelope-encrypted documents
Files are encrypted in the application with AES-256-GCM under a per-vault data key, wrapped by an AWS KMS master key in Cape Town that never leaves the hardware. Uploads pass through an in-country quarantine bucket and a malware scan, and only ciphertext ever reaches object storage.
A release engine with four ways in
An operator's intake after a report, any two nominees, an executor with an account, or an inactivity check-in nobody answered, all landing in one case model. A fourteen-day safety window, the owner's own sign-in as a brake, and Home Affairs corroboration before approval. The sealed vault is crossed in exactly one database function.
Security as the data model
The database is the security boundary: forced row-level security under a non-owner role, an append-only audit log enforced by trigger, roles the app can't write, TOTP multi-factor authentication, revocable HttpOnly sessions, a per-request nonce content security policy and signed webhooks.
An operator console
A separately gated console for the company's own staff, MFA required: the release queue with evidence and decisions, identity reviews, users and plans, an analytics dashboard that reads aggregates and never rows, an audit-log viewer and a gallery of every email the system sends.
Billing with a safety catch
Plans live as data, managed in the console and synced to Paystack per billing interval, with single-use payment references, overdue lockout and PDF invoices. A stopped payment never destroys a vault: only the owner's in-app cancellation starts a thirty-day countdown, and destruction is one function that deletes the keys first.
Nearly there, and built to be tested.
- Every milestone in the spec has been delivered to staging: foundation, vault core, release engine, POPIA tooling, notifications and the operator console.
- Fifty-six numbered decision records and a written security model, so the penetration testers and the client's own team can follow the reasoning behind every choice.
- Personal data stays in Cape Town: the database, key management and quarantine storage all run in-country, and only encrypted objects leave it, with consent captured at registration.
- Isolation is proven, not assumed: row-level security and append-only suites run against a live Postgres in CI, alongside end-to-end tests with accessibility checks, on every change.
- Destroying a vault's keys is enough to make its documents permanently unreadable, and destruction never runs while a release case is open.
- Next: the independent penetration test and the client's POPIA sign-off, then launch.
From a fifteen-page spec to a product.
We wrote the scope with the client before a line of code: what would be built, what wouldn't, the four decisions only they could make, a fixed price and a milestone plan. Since then the build has shipped in milestones, each demonstrated and accepted on a staging environment, with every decision documented as we go.
- Scoping & specification
- Product design
- Frontend
- Backend
- Security architecture
- Infrastructure