NOTE: If anyone downloaded the new Trust Mesh spec, I discovered midweek that it merged incorrectly, plus the new approach adds some additional residuals, so I’m going to harden and/or close everything that is within the scope of design and cryptography, then do one more deep dive into the best version of a sealed reference that could be deployed on consumer phones in a way that reduces collisions and duplicates most effectively. I’ll write up a final article on my findings and post the completed spec soon.
Today’s article highlights how the sovereign digital vault works and its broader applications. I believe this combined with Trust Mesh creates a layer of privacy and security that our digital systems will be required to have in the era of AI, and I’m proposing this is the best way to do it. I’m putting the finishing touches on this specification as well and hope to have both ready next week.
4,900 words
The Future of Our Digital Systems - Part Two
Intro
While the roadmap is toward a fully decentralized, sovereign vault on your phone, where you control the records, permissions and relationships you use across different services, the Creator Vault is the initial product that gives creators a direct route to their subscribers. The company builds the app and runs the business, while a small network of independent operators provides delivery. This gives creator connections a delivery route independent of the originating company from the beginning, with decentralization growing as the vault’s uses expand.
The network evolves from creator connections into a multipurpose vault with separately protected services, network-assisted security and recovery, and broader decentralized governance. This article explains the Creator Vault, then how the security and governance of the network would operate at full maturity.
The Creator Vault
A creator can spend years earning an audience’s attention. A subscriber can spend years finding the people whose work is worth their attention. The connection they form deserves a record both can keep beyond the platform where they first met.
Creator Vault is designed to give fans one inbox for the creators they choose to follow, wherever those creators publish, and give creators a direct way to reach those fans when a platform changes the rules or algorithms that determine their reach.
A creator posts a video or article, then sends a notice with a link directly to their fans, who see it alongside notices from the other creators they chose to follow. The published work stays on its original platform. Notices arrive in publication order, and the fan can pin or mute creators with settings that stay on their own phone.
For Creators
You gain a direct route to fans who ask to hear from you that is independent of the platform. Send a publication notice into their Vault inbox without competing for a limited position in a recommendation feed on their home screen, so your next release has a place among the work they chose to follow.
You keep a portable record of each fan’s permission to receive your notices. Both of you hold a copy of that agreement, so the years you spend building an audience can serve you wherever you choose to publish. An email list gives you addresses. The Vault gives you a signed record of each fan’s permission, the settings and tier they chose, and the route to reach them directly.
If you have a team, you can share publishing permission without handing over control of your vault. The design also provides for members-only notices to fans whose paid status you confirm through your own payment processor.
For Subscribers
You get one place to keep up with the creators you care about across different platforms, with controls to prioritize their notices. Tuesday’s podcast arrives beside a photographer’s new tutorial and a newsletter release. Each notice is a link that takes you to the platform when you are ready to open it.
The inbox keeps notices in publication order, with optional recommendations clearly distinguished from followed creators’ notices. You choose whose work belongs there and when to open it.
How Do A Creator And A Fan Connect
The creator shares a follow link or a QR code when they publish content. The fan downloads the Vault app for free and chooses to follow. The connection does not require sharing an email address. The link can sit beneath a video, and the QR code can appear at the end of a live event.
Both apps keep a signed record of that choice. The creator can set a policy that automatically accepts matching requests, so a large audience does not mean approving every follow by hand.
Their Vault apps use digital signatures to record what was agreed, and the records are encrypted on their devices. Each subscription uses a different identifier, so following several creators does not give those creators a common tracking number for the fan. Each connection carries its own permission. The fan can end the follow at any time. Export preserves the signed agreements and their permissions, and import restores them into the Vault app.
Do I Have To Leave The Platforms I Already Use
No. Creators keep publishing where they already publish, and fans follow the link to watch or read the work there. There is no need to upload a second copy to the Vault. If a creator later moves a show or publishes somewhere new, the next notice can link to that place using the permissions fans have already granted.
This is useful for ordinary growth as well as an unexpected move. A writer can tell existing readers about a podcast they are starting and have notifications of their publications for both services arrive in one place.
The Vault hosts no videos or articles. Every notice sends fans back to the service hosting the work.
How The Service Operates At Launch
The Vault company builds the app, runs the business and provides customer support, software updates and hosted services. Delivery uses a small network of independent relay operators from the beginning. Each ordinary connection uses at least two independent operators, with the Vault company running at most one of its relays.
The company can suspend use of its own hosted service, and an outage can interrupt that route. An independent delivery route remains on the connection. Continuing to use it also depends on a working app and access to the user’s keys. This establishes delivery independence at launch while compatible apps and broader shared governance develop.
How We Protect Your Vault
Agreements are encrypted on users’ devices. The delivery service carries encrypted messages, and backups remain encrypted. Delivery and alert services can observe some timing and connection information, but that does not give them readable agreements.
Ordinary unlock uses the phone’s built-in biometric security for a limited session. Sensitive actions, including adding a device, bulk export of records and changing recovery settings, require fresh authorization. On supported phones, protected hardware enforces key use. There is no separate hardware key to buy or carry.
Publishing permission is separate from recovery authority. The app limits access to the records needed for each task and protects notifications, logs and backups from exposing private contents. Security testing, release review and incident response remain part of operating the product.
Recovery And Portability
Encrypted backup and tested export/import are part of the launch. The recovery design uses three pieces, with any two able to open the recovery package when the encrypted backup is available. Restoring records and restoring authority to act on a connection are separate steps. Possession of the required pieces and backup makes the stored records readable, which is why the pieces need separate safekeeping.
Setup includes a recovery rehearsal. Company support cannot bypass the required keys and reset a vault. The launch is for creator connections; storage of higher-value records and credentials is outside its scope.
Controlling Spam
Rate limits and admission controls restrict follow requests and other actions that can be abused. Fans can end a follow, mute notices and report abuse. These controls do not require proving that every account belongs to a different human.
Can I Still Discover New Creators
Yes. The design includes a searchable public creator directory and recommendations from creators themselves. Someone whose work you already enjoy can point you toward another person worth following, so creators can introduce their audiences to each other.
You control whether suggestions appear. Optional discovery uses interests kept on your device, with limits on how many suggestions can appear among notices. The design allows flat-fee promoted suggestions, clearly labelled Sponsored, and separate Promoted placements in discovery results. Payments never change the order of organic results or the notices from creators you follow, and you can switch suggestions off entirely.
Discovery is optional. The first business plan does not depend on promoted listings, and they are not included in the financial model.
What Does It Cost
The pricing commitment is to keep the basic Creator Vault service free for subscribers. The planned invitation-only creator pilot is free too. After the pilot, the pricing plan is one flat creator fee plus usage charges for delivery and storage. Rates are set from measured costs and published before anyone is charged. Optional hosted services include automated follow acceptance and extra backup storage. The Vault takes no percentage of a creator’s sales, and there is no fee simply for adding another connection.
Creator fees fund delivery, storage, security and support, including payments to independent operators. Subscribers are not charged each time they unlock their vault or approve an action. During the free pilot, company funding pays the operating costs.
Building The Business
The first thing to build is a product that creators and subscribers want to use. The investment model is equity in the company building the app and selling its services. Revenue comes from useful software, reliable delivery, hosting and support.
What The Pilot Proves
The pilot tests the basic experience: download the app, follow a creator, receive a publication notice, mute or end a follow, export and restore records, and recover after losing a phone. It also measures delivery and storage costs, support needs, subscriber retention and creators’ willingness to pay.
The initial appeal is to creators who value independent thought, free speech, truth seeking, and control over their relationships with subscribers, especially those exploring controversial topics or speaking truth to power. Writers, podcasters and educators who already publish in more than one place are another natural audience.
The pilot tests whether these creators and their subscribers use the inbox, whether enough creators will pay for it, and whether delivery continues through an independent operator when the company’s delivery service is unavailable. Once the pilot proves demand, outreach to creators with large audiences, such as Joe Rogan, could help expand adoption.
Creator Vault Network Operation And Security
This section describes the mature network: who operates it, how authority is divided, how private records are protected, and how the services are funded. The available technical specification describes the mature network. Additional security constructions, including separately protected service compartments and network-assisted authorization and recovery, are being hardened alongside the specification.
Beyond Creator Connections
Creator connections are the first use. The same foundation could give people a private place to store important documents, keep purchase records, manage account permissions and make agreements that remain theirs when they change services. For agreements, each person keeps a signed record of what they accepted, with later changes becoming part of that history.
The shared rules cover how records are stored, signed, exchanged and carried between compatible apps. A contractor’s business app and a homeowner’s personal vault could exchange the same work order without being made by the same company. Publishing those rules does not make anyone’s private records public.
Buying And Selling Online. An agreement template could record the item, its condition, the price, payment and delivery terms, and any return agreement. Buyer and seller would each keep the accepted terms, with payment confirmations and delivery records added as the transaction progresses.
Personal Documents. People could keep insurance policies, warranties, school records and other important documents in separately protected compartments, with permission to share a particular document without opening the rest of their vault.
Private Files And Backups. Photos, notes and personal archives could remain encrypted in the vault, with encrypted backups held by storage providers. Changing the app or provider would not require giving up control of the files.
Work Agreements. A designer could keep the agreed brief and price alongside approved revisions and delivery records; a contractor could use the same pattern for an estimate and later changes to the job. Both parties would retain the accepted terms when either changes services.
Delegated Tasks And AI Assistants. A person could give another person or a connected assistant permission to carry out a defined task. Participating services could check that permission’s limits and return a record of the actions taken.
Those are possible later uses, not features promised for the first release or revenue included in the plan. Keeping a signed record also does not, by itself, make a property transfer or a contract legally effective.
How The Network Grows
The creator launch establishes encrypted agreements, participant-held keys, usable exports and recovery, with independent delivery from the beginning. As adoption grows, more providers offer delivery and storage, compatible clients give people a choice of apps, and broader shared governance distributes authority over the network’s rules.
Each expansion has a working test: a compatible client imports existing agreements, recovery works without company infrastructure, and the network continues when the company’s services are removed. Existing agreements and permissions carry forward without asking every fan to follow again.
The company publishes transition milestones and reports progress against them. Transferring shared authority requires published notice, compatible software and successful continuity tests. This transition is separate from the protocol’s patent license, which follows its own published terms.
How We Secure The Network
A corporate product could offer an inbox, encrypted agreements and backups. So why decentralize it? Because the creator and subscriber should be able to keep their relationship when the company changes its policies, stops serving them, makes mistakes, or even disappears. If one company controls the only usable app, delivery route and list of approved providers, it still controls that relationship. Independence is the allure and entire point of the product.
Encryption protects the agreements. Decentralization gives people independent delivery routes, compatible apps and shared authority, so no company, including Vault, has exclusive control over their connections. The company can still build secure software, fix vulnerabilities and respond to attacks. The job is to keep those protections while separating the powers that could be used against the people relying on them.
How The Network Operates
A relay is a post-office box. The sender drops a sealed envelope in a box with a random address and no name, and the relay holds it until your phone checks in. It cannot open the envelope, but it can observe delivery and collection activity. A service that sends your phone alerts can also see some timing and connection information. Readers who know Nostr will recognize relays. What differs is the record: a signed agreement held by both people with the fan’s permissions inside it, and a mailbox that connects them.
The creator network starts with at least three independent relay operators. The same independent-route requirement continues as the network grows. A creator or creator cooperative can operate a relay, but several servers under one company’s control count as one operator.
As the network matures, the app, delivery, alerts, backup and discovery can come from different providers. No board gets a master key to everyone’s vault. Compatible apps and usable recovery arrangements extend independence beyond message delivery.
Separating Access Inside The Vault
The mature design extends the two levels of authorization described earlier to the records themselves. A creator inbox does not unlock a compartment holding sensitive documents or credentials. Each service receives access only to the records and actions the person has allowed, with separate encryption keys and isolated access. Using one service never gives it access to the whole vault.
That is how we limit the damage of a compromise. One service does not get another service’s records, and notifications, search indexes and backups preserve the same separation. Software controlling a device after a legitimate unlock can copy what that device is allowed to read; limiting that access is the purpose of the compartments.
Using The Network To Protect Sensitive Access
Sensitive compartments require both the user’s protected key and cooperation from independent network services. The phone requests the network’s help after local authorization, and the services check the enrolled device, the requested operation and its permissions. The face scan stays on the phone. This does not require Trust Mesh to establish a unique identity, and a future Trust Mesh integration could complement it.
The network’s part is divided among independent services, with a threshold required to cooperate. A three-of-five arrangement is the candidate configuration for validation. No service holds the complete network secret, and even a cooperating group still needs the user’s separate secret to decrypt the compartment. Splitting the entire decryption key among operators would give a sufficient group the ability to reconstruct it, so the user-held secret remains separate from those shares.
For the user, this looks like a fresh Face ID approval followed by a connection to the services. Each approval applies to the particular compartment or action, expires promptly and cannot be reused for something else. The app does not retain an unrestricted key that bypasses the network on later unlocks. Cached inbox reading remains local; opening a compartment with this stronger protection requires enough of its services to be online.
Those services follow defined rules for changing devices, replacing a failed provider and changing recovery settings. Each change requires authorization under the existing protections. No operator can weaken those protections by changing an account setting, and no action depends on the Vault company’s participation.
Can The Key Shares Be Anonymous
Key shares are stored under random identifiers instead of names, email addresses or a public vault number. Each provider receives a different identifier, and private access requests stay out of the network’s public governance log. That reduces the information an operator holds and makes records harder to connect across services. This provides pseudonymity: network activity can still reveal connections, and decrypted records may identify their owner. Unlabelled shares add privacy, while the separate user secret prevents the network group from decrypting the protected records alone. Some creator subscriptions are public, but the Vault does not assume that people want their connections exposed. The design limits information leakage even for ordinary follows.
What Could Someone Capture And What Is The Prize
A hacked relay would not reveal the agreements inside your vault. It could delay messages or observe traffic patterns. Capturing the authorities that recognize providers could let an attacker exclude competitors. Compromising software distribution could give an attacker a route onto users’ devices. These are different powers, so the design separates them. For public subscriptions, some connections may already be visible on a publishing platform. Private records and future services can be more valuable, which is why protection cannot depend on assuming there is nothing worth stealing.
How Many Approvals Are Needed
Different powers require different approvals. Relays deliver messages under the permissions in each connection; they do not vote on each delivery. The design requires at least five independent authority holders to approve changes to the list of recognized services. With five holders, an ordinary change needs three signatures. The required majority grows with the group, and revoking a key does not quietly lower the threshold.
Independent witnesses check that the public record is consistent. They do not decide which operators are approved. Software releases have a separate approval policy, so authority over the provider list does not automatically grant authority to distribute an app update. The specification defines the thresholds and how those policies can change.
Independent release review and signature checks protect software updates. Their enforcement depends on the distribution route; app stores do not provide the same safeguards on every platform.
If too many authorities disappear, the current design can freeze rather than let a smaller group silently take over. That protects authority at the cost of availability. Public logs can expose conflicting changes, but they cannot force an operator to deliver a message or restore a lost signing key.
Who Runs These Services And How Do They Get Paid
Operators include the Vault company, creators or creator cooperatives, and independent businesses providing hosting, delivery, security or backup. Directory authorities represent qualified organizations with separate control. Witnesses and release reviewers perform the technical checks attached to their roles. Recruitment and qualification establish that independence before a service counts toward the network’s operating requirements.
Operators earn service fees funded by the products that use the network. Future services include their share of network security and recovery costs in their pricing. Operators are paid for providing the service, not for approving particular requests.
A creator can pay a provider directly, or the Vault company can include the service in its bill and pay the provider under a disclosed contract. Providers can settle usage charges among themselves. A creator running a relay can cover its costs, support a community or operate a service business. Measured operating costs determine sustainable rates.
The Vault nonprofit budgets for public infrastructure, independent review and witness services through disclosed grants, dues and service contracts. Payments buy no extra votes. Independence includes funding: if every operator depends on a contract the Vault company can cancel, separate company names provide little protection.
Would Software And Hardware Attestation Help
Attestation can provide evidence that a machine is running an approved configuration, and hardware-protected signing keys make theft harder. Independent code review and checks that a released app matches the reviewed source help prevent malicious updates. These controls work alongside independent operators and public records of shared decisions.
Approved software does not prove independent ownership, and an operator can still turn a service off or block traffic. The network therefore needs separate owners, administrators and credentials, multiple delivery routes, and tested ways to change providers. An approved but malicious release is a separate risk that code review and release controls must address.
How Does The Vault Limit Spam
The full-network design limits certain requests through admission tokens issued by independent services. At least two issuer operators must be available in the default configuration. These are alternative sources of tokens, not two votes required for every follow. The controls raise the cost of mass abuse, but multiple installations or issuers can still let one person obtain more tokens. They do not establish one account per person.
The network operates without Trust Mesh. A future integration can add identity-related protections under its own design. It does not replace protection of operators, software releases or governance.
How Recovery Expands With The Vault
The creator recovery arrangement restores stored records separately from authority to act on a connection. A waiting period protects changes to that authority; it does not postpone reading a copied backup once someone has the required recovery material.
Sensitive compartments have their own recovery protection. Ordinary inbox recovery does not unlock them. The recovery construction uses an app-generated secret kept outside the lost phone together with independent recovery services. Face ID on a replacement phone cannot establish that it belongs to the previous owner. The network cannot replace the user’s secret on its own: doing so would give it the power to unlock the data on its own.
Recovery that replaces authority includes waiting periods and notifications, with different procedures for subscribers and creator roots. The specification defines those procedures. For sensitive compartments, loss of every enrolled device and the independent recovery secret means loss of access. Setup explains that choice and provides accessible authorization options without silently weakening the selected protection.
The Company And The Nonprofit
Under the proposed governance model, a separate nonprofit holds the defined Vault protocol patent rights, shared specification and certification mark through formal asset assignments. Its board represents creators, subscribers, independent developers, operators, security and the company. The company has one seat, and the founder and investors have no permanent veto over the shared standard. The founding charter sets the board’s size, seat allocation, appointments and reserved decisions.
Changes to shared rules are published, reviewed and tested before a vote. Major changes to licensing or the charter require a higher threshold than routine changes. A board vote cannot rewrite permissions in existing connections. The nonprofit’s board, the directory authorities and the software release authorities perform different jobs; holding a board seat does not grant signing keys for every role.
How Shared Authority Evolves
The company retains control of its product, staffing, budget and commercial services. The recognized-operator list already requires independent approval; broader shared governance develops as more participants and compatible systems are established. In the mature five-holder directory example, Vault’s signature is not mandatory: three of the remaining four holders can approve an ordinary change if Vault disappears.
The company has no mandatory veto over the mature network. A directory vote does not authorize a software release, and a software-release approval does not supply a user’s signature on an agreement. Different powers remain separately controlled.
The network needs tested ways to replace failed services and rotate authorities while preserving the required approvals. Raising thresholds makes capture harder, but enough approvers must remain available for decisions to proceed.
Licensing And The Commercial Model
The proposal is a limited commercial lead window of four to five years, followed by a fixed opening date for royalty-free implementation of the core protocol under the nonprofit’s essential Vault patents. The length and exact license still need to be settled before financing. A published specification, an open-source app and a royalty-free patent license are different things; the documents have to say what is being offered.
Opening the core could make the company’s market larger. Other developers could bring new users and applications into a compatible network, and the company could sell its services into that network. It would also face competitors. This only makes sense if customers keep paying because the product is useful and well run. Releasing the application’s source code is a separate decision from opening the protocol’s patent license. The choice depends on how it supports adoption and the business.
Validation Before The Full Network Operates
The network profile is tested against operator failure, collusion and company disappearance. Delivery continues through independent routes, replacement clients preserve agreements, and recovery follows the same permissions outside company infrastructure. Distinct company names do not count as independence when administrators, credentials or controlling owners are shared.
The additional security constructions require tests showing that ordinary unlock cannot open a sensitive compartment, ordinary recovery cannot bypass its protection, and modified app code cannot fake hardware authorization. Approval replay, changed recipients, expired requests and policy rollback are rejected. Adding a device or changing a recovery provider requires the existing authority. Notifications, logs, indexes and backups do not leak copies outside their compartment.
The threshold implementation also has to withstand malicious participants, replace and refresh shares safely, authenticate responses and protect the user-held factor through recovery. A threshold must be available for protected access; too many unavailable services stop that access. These constructions are carried into the specification and hardened before their security claims are treated as implementation evidence.
Trust Mesh
The Vault could become a practical foundation for Trust Mesh as more people use it to hold records, manage permissions and carry relationships across services. A future integration could connect those capabilities to Trust Mesh’s identity and verification system, letting participating services check claims and permissions without taking control of the underlying records. That creates a path toward the broader vision, but the Vault stands on its own: a useful product and network with its own customers, revenue and purpose, whether or not Trust Mesh is created and adopted.
Ideal Investor
I ran a small business for seven years, so I understand the practical and interpersonal challenges. But I am on Earth to create, so I’m not interested in running a software company. That is why teams exist.
The ideal person to lead this has already built successful software and a business. You understand both the Vault and Trust Mesh, see why people would want them, and recognize the direction our digital systems need to move in terms of privacy, security and self-sovereignty. You likely have some public presence or established relationships that could open doors to creators and influencers who would help drive early adoption. You may even have relationships with the current administration that would help with research grants for Trust Mesh while Vault is built.
You also understand that while a business exists to make a profit, there is also a larger mission here: protecting people from fraud and the imbalances of power. I believe this could evolve into something with a much larger impact than people might imagine right now. The risk/reward is very asymmetric. Follow your intuition on this. My contact will be on the specs next week.
