If you read nothing else, read this. It is the difference between a locked door and a lost life.
Nobody at BendFlex can open your vault. We hold no key, no copy and no reset. If your passphrase and your recovery are both gone, your data is gone permanently, and no amount of proving who you are will change that. This is not a policy we could bend. It is what makes the device worth owning.
| If this happens | You use |
|---|---|
| You forgot your passphrase | Your recovery card, or your guardians |
| The device is lost, stolen or dead | Your backup file plus your recovery words, on a new device |
| You have died or cannot act | Your guardians, together |
A single card in a drawer is fragile. It gets lost in a house move, thrown out in a clean-up, or destroyed by the same fire as everything else. So the device can split your recovery into three pieces given to three people, where any two together can open the vault and no single one can.
Each piece is real key material, not a receipt. Produce them offline, hand them over in person, and tell each guardian plainly: keep this like cash, never photograph it, never email it. Two pieces reaching the same email inbox undoes the whole arrangement. The options and their trade-offs are set out in Chapter 01.
Most people find out their backup never worked at the exact moment they needed it. So the device asks you, four times a year, to spend ten minutes proving it does.
The home screen keeps a running account of how recoverable you actually are.
It is meant to be slightly annoying. Everything on it is something that would matter enormously on one specific bad day.
The device slows down after a few wrong attempts: a few seconds, then longer. It is only a delay, and it exists to stop somebody standing at the device from guessing their way in.
The delay is not what makes a stolen device safe, and we would rather be straight about that. A thief does not stand there typing guesses. What protects you is that the storage itself is encrypted with a key the chip will not hand over, and that your passphrase is put through a deliberately slow calculation that makes bulk guessing expensive.
Which means your passphrase is doing real work. A long one you can remember is worth more than every other measure on this page.
There is no setting that wipes the vault after too many wrong tries. An elderly parent getting confused at the screen is far more likely than a burglar patiently guessing, and we will not build something that punishes the first to defend against the second. Wrong attempts make it wait. They never make it forget.
After enough failures the device stops asking and points you at your recovery words or your guardians instead. If nothing is left, Chapter 10 is honest about what that means.
BendFlex · VaultPlug Guardian · Owner's Manual v1