Architecture crafted for
life's continuity.

Where does my data actually live?

We use Amazon's data centres in Mumbai (ap-south-1). Our system is “serverless”: there are no Soult-managed servers to patch or log in to, and AWS secures the underlying machines. That reduces the attack surface but doesn't remove it — our APIs, sign-in and cloud configuration still need protecting.

Where does each user's data go?

Today Soult runs as a single silo in AWS Mumbai, India, and every user's vault is stored there. We're preparing to launch in the UAE. Vaults for users there will be stored in AWS Mumbai (India), and we'll ask for their explicit consent to that at sign-up. Separate regional silos are on our roadmap.

Local compliance and security.

AWS Mumbai gives us a mature, independently audited data-centre footprint in India. Keeping your data on Indian soil means your legacy follows Indian law and stays within reach of your family without complications.

Sign up and log in safely.

Registration: verified via Phone OTP and Email OTP. You set a security question and a 4-digit MPIN. Trusted use: daily access requires only your 4-digit MPIN. New device: triggers 2-factor security — phone OTP first, then your MPIN.

Why can't my family open this?

In shared-phone homes, fingerprints allow anyone enrolled to enter. A private 4-digit PIN keeps your vault private while kids play games or your spouse uses the phone.

Is 4 digits really secure?

Yes — because the protection is the lockout, not the length. Three wrong tries and your vault locks for 24 hours. Even a thief with your phone gets only 3 guesses before the door slams shut. We chose 4 over 6 deliberately: longer PINs cause more forgotten codes, lockouts, and resets — and memory complexity is the real enemy of security in practice, not raw entropy.

What if someone steals a hard drive?

Data is AES-256 encrypted at rest. Stolen hardware contains only meaningless ciphertext. Encryption keys are managed by AWS, separately from the data — never on the same disk.

Who holds the keys?

AWS does. Our field-encryption key lives inside AWS KMS hardware security modules and never leaves them in readable form, so no one at Soult ever handles the raw key. Our application asks KMS to use it when you save or reveal a protected field, which is what makes a verified family handover possible. Keys for files and database tables are managed by AWS.

Double-lock security for your most sensitive fields.

For your most sensitive details — national ID, tax ID and passport numbers, card and account numbers, and Standard Password Keeper passwords — we add a second lock. Our servers encrypt each of those fields with an AWS KMS key before saving it, so in the database they are stored as ciphertext.

Which secrets can even Soult never read?

The Password Keeper has two levels. Everyday logins — Wi-Fi, streaming — unlock with your app MPIN, and we can help you recover them. For your most sensitive logins you turn on Advanced, which is locked end-to-end with a vault password that never leaves your phone. Adding an Advanced entry needs no password at all; only reading one does. We store the locked result and never hold the means to open it — so there is no Soult decrypt button, no staff override, and nothing meaningful to hand over under a legal order. You also get a 12-word recovery phrase, shown once, that we never receive. That is the honest trade-off: lose both the vault password and the phrase and those passwords are gone permanently, because the alternative would mean us holding a key. Only the password itself is sealed; the entry's title, username, website, notes and security question and answer use Standard protection.

Spy-proof Wi-Fi.

Data travels through a secure TLS tunnel. Anyone snooping on public airport or café Wi-Fi sees only encrypted gibberish — nothing about what you upload or read.

Can Soult staff see my secrets?

Not in routine operation. Soult personnel do not view your vault content in the normal course of work; access to production systems is restricted by IAM and logged. When a death claim is being reviewed, a small number of authorised staff can open the documents in that account, and each such access is logged. Your most sensitive fields are also stored as KMS-encrypted ciphertext.

Who can ever see my vault?

Regular Executor (typically a family member): has their own dashboard listing the people they're named for. Can raise a death claim. Only after Soult verifies and approves it can they sign in — with phone and email OTP — and see your vault.

Emergency Executor (any trusted person you choose — spouse, child, sibling or friend): no death claim needed. Can sign in at any time after phone and email OTP. You get an email as soon as they sign in.

Both roles see your vault in read-only mode. The emergency role is for medical emergencies and time-critical situations; the regular role is for handover after death. How many executors you can name depends on your plan.

How does my family actually get access?

The named Regular Executor raises a death claim from their dashboard and uploads a death certificate; you and your other executors are emailed. An authorised Soult administrator reviews the claim and certificate before approving it — nothing is released on an unverified request. Once approved, your account becomes read-only, and the executor signs in with phone and email OTP to view and download the vault. An email goes to your registered address each time an executor signs in. Advanced Password Keeper passwords stay locked unless you have left your executor your vault password or Recovery Kit.

Can I share one document with my CA or spouse?

Not today. There is no per-item sharing, no per-folder access for an accountant, no time-limited share link. The only way another person ever sees inside your vault is through the executor flow described above — and then they see everything in read-only mode. There is no per-item or per-folder granularity yet.

What are the risks?

We work to protect against hackers, account takeover, and insider access. We cannot stop you from being physically forced to share your PIN. Soult is for organisation and family continuity — not protection from a coerced disclosure under duress.

Where exactly does my data live?

Today, all vault data sits in our India silo in AWS Mumbai. We're preparing to launch in the UAE. Vaults for users there will be stored in AWS Mumbai (India), and we'll ask for their explicit consent to that at sign-up. Future silos for the US and Southeast Asia, and a dedicated GCC silo, are on our roadmap.

What happens at each level of failure?

Tier 1 — one server fails: invisible to users; AWS's managed services replace it automatically.
Tier 2 — one Mumbai data centre fails: service continues, because your data is already stored across several data centres in Mumbai.
Tier 3 — the whole Mumbai region goes down: service pauses until AWS restores it. A standby in a second region is on our roadmap, not live today.
Tier 4 — the Mumbai region is permanently lost: we cannot fully recover from that today. Cross-region backup replication is on our roadmap. Until then, keeping your own backup is the strongest safeguard.

Record of changes.

A record of every Create, Update or Delete on your vault, with who made the change and when.

No selling, no training, no surprises.

Your vault content is never used to train AI models or for marketing. When AI features are used in the app, the data for that session is processed in-context only — never retained for model improvement. Revenue is subscription-only. If we ever consider a new way of earning — any change at all — we will ask you first. Not notify. Not announce. Ask. And we will only ask if we genuinely believe it benefits you.

The bridge choice.

Chat apps focus on absolute secrecy — if you lose a key, they can't help you. That is a failure for a life vault. So we designed Soult differently: your vault is recoverable by design, so a lost phone or forgotten PIN never locks your family out, and verified executors can receive what you left them. Soult personnel do not have routine access, and handover happens only through a verified path. For the few passwords only you should ever open, Advanced Password Keeper gives you sole custody. Soult is a bridge to your legacy, not a digital dead end.

What is shipping next?

Near-term: one-click vault export (today users back up manually); US silo (N. Virginia, DR Oregon); SEA silo (Singapore, DR Jakarta); cross-silo backup replication so something always survives even if a whole region is lost.

Mid-term: a dedicated GCC silo; SOC 2 Type II.

Always-on: ongoing audits, security hardening, infrastructure reviews.