How a zero-knowledge digital vault went from idea to live product through Prove → Build → Grow.
FamilySafe is a zero-knowledge, end-to-end encrypted digital vault for personal records — finance, legal, identity, health, digital assets. Users store cards organised by category, share them selectively with family, guests and professional advisors, and nominate executors who can unlock a "probate" subset of the vault only after a verified death — and only if a configurable threshold of executors collaborate.
The product's defining promise is uncompromising: the FamilySafe servers cannot decrypt vault contents under any circumstance — not with a database dump, not under court order. The release rules are enforced cryptographically, not by policy.
That promise is also what made FamilySafe a high-risk build. If the cryptographic design didn't work end-to-end in the browser, in production, the product had no business case.
This is how we took it from idea to live product across our three engagement stages.
Where the idea becomes real.
If the answer was no, there was no product. So that's where Prove started.
The Executor Key Management and Death-Unlock subsystem. Specifically, a working two-layer Shamir's Secret Sharing scheme implemented end-to-end:
KC) sealed server-side with a key that lives only in a Kubernetes Secret; the other share (SE) leaving the server entirely.SE across executors, with the threshold configurable by the vault owner (any one, any two, all of them, or "at least N").KC until an admin verifies a death certificate.We built it in production-grade .NET 9 + React + MySQL — not a slide deck, not a notebook prototype. The POC ran the full flow:
At the end of Prove, the client had cryptographic proof — running in real code — that the product they wanted to build was buildable. Every subsequent decision was made on a foundation that was no longer hypothetical.
Where the product gets built — feature by feature, in front of the client.
With the riskiest feature de-risked, Build turned the roadmap into a product, one feature at a time, in front of the client.
Every feature followed the same loop:
The full FamilySafe platform was built as a sequence of slices, each shippable and reviewable independently:
EndpointCache at boot; routes not seeded are blocked at the middleware.DEV_PASSWORD_ONLY bypass for testing, gated to localhost/preview hosts and a config flag — physically incapable of activating on live.key_templates / key_user_defaults / key_share) covering single-card, category, and global shares.cipher/iv/tag populated then)./kc endpoint — the gate that enforces "cannot decrypt before death is verified" at the network layer, not just the UI.PK, re-encrypt probate cards, re-split shares, revoke old, rotate kc_enc.billing_anchor_at that never drifts.last_billed_at check.payments.confirmed, failed, cancelled, paid_out, plus mandate lifecycle. Signature validation done correctly: HMAC-SHA256 over the raw body, lowercase hex, constant-time compare.Processing past LOCK_TIMEOUT_MINUTES are requeued by sp_email_queue_requeue_stuck and may be claimed by another worker.mysqldump --single-transaction --hex-blob (the --hex-blob flag is mandatory for FamilySafe's BINARY(16) UUIDs and encrypted VARBINARY columns — without it, restores corrupt).backup_user MySQL account; Wasabi credentials are write-only; both in a single Kubernetes Secret.sp_add_auth_security_event).A production-deployable FamilySafe — fully encrypted, fully tested, fully auditable — handed off to a Kubernetes cluster on Civo with Traefik v2 ingress, Cert-Manager managing Let's Encrypt certs, and DNS pointing at a single LoadBalancer IP serving four domains.
The client knew, the day Build ended, exactly what was running and exactly how it worked — because they had been watching it grow for months.
Where the product stays alive and gets bigger.
FamilySafe is live. We run it. Same feature-led philosophy — small features, short cycles, continuous progress — alongside everything that keeps the product alive and growing.
www.familysafe.co.uk, api.familysafe.co.uk, vault.familysafe.co.uk, and the company brand domain.Recent and in-flight slices since launch:
Each one ships to the preview environment first, gets signed off, then promotes to live — same loop as Build, just continuous.
FamilySafe's riskiest thing — a server that genuinely cannot decrypt its own customer data — is also the thing that makes it a viable product. Building that first meant the client never paid to discover, six months in, that the foundation didn't hold.
Every feature went to the preview environment the day it merged. Every status was on the board, in real time. The client has the entire product wiki on their own infrastructure. There were no surprises — and no $50k bills for "discovery work" that never materialised.
There was no handover gap, no "we'll need to ramp up on the codebase" delay. Day-one of Grow looked exactly like day-N of Build — small features, short cycles, shipped to preview, signed off, promoted. The product gets faster, smarter, and bigger every month, and the client builds none of it.
| Stage | What we delivered for FamilySafe |
|---|---|
| Prove | End-to-end working death-unlock crypto in production code; full architecture; data model; risk analysis; shippable roadmap; client-owned spec. |
| Build | Full vault platform — auth/2FA, vault encryption, sharing, probate, executor management, billing, email infrastructure, backups, admin tools — built feature by feature, visible in preview throughout. |
| Grow | Live infrastructure on our estate; continuous security and patching; ongoing feature slices (AI chatbot, performance, UX); monitoring and dashboards; chatbot ownership; planned AI marketing agents and AWS cost engineering. |
Up to £15,000. Fixed, scoped before work starts.
Scoped from the Prove output, fixed before work starts.
Monthly retainer, sized to the product.
For FamilySafe-scale products — multiple cryptographic primitives, payment integration, asynchronous worker infrastructure, multi-tenant sharing, a probate workflow with regulatory implications, live infrastructure on the partner's estate — Grow is sized at a level that costs less than hiring a single mid-level engineer and delivers an entire team plus the platform they run on.
If your product has a riskiest feature you'd rather not discover the truth about in month nine — that's a Prove engagement.
If you've got the proof and you want to ship without status meetings or ten-page weekly reports — that's a Build engagement.
If you want a team that builds the thing, runs the thing, and grows the thing — without you ever owning a Kubernetes cluster — that's Grow.