UnoLock for High-Risk Individuals: A Technical Guide to Digital Survival Under Coercion

When Exposure Means Death, Imprisonment, or Irreversible Harm

Introduction: This Is Not Paranoia

If you are reading this document, you face threats that most people consider abstract or distant. Perhaps you are a journalist protecting sources in a country where journalism is criminalized. Perhaps you are a dissident organizing resistance against an authoritarian regime. Perhaps you hold significant cryptocurrency wealth and live in a region where kidnapping for ransom is common. Perhaps you are fleeing domestic violence from someone with technical sophistication and resources. Perhaps you are a whistleblower carrying evidence that powerful entities want destroyed. Perhaps you cross borders regularly where authorities demand device access and refusal means detention.

You do not need philosophy about digital sovereignty. You need specific technical capabilities that function under the worst conditions. You need protection that holds when someone has physical access to your device, when violence or threats of violence compel you to provide credentials, when forensic examination of seized devices could expose information that endangers you or others, when the wrong data in the wrong hands means imprisonment, torture, or death.

This document describes how UnoLock's architecture addresses these specific high-risk scenarios. It does not minimize the danger you face. Technology cannot solve all problems, and no system protects against unlimited adversaries with unlimited resources and willingness to use unlimited violence. But within the constraints of what cryptography and architecture can provide, UnoLock offers specific capabilities designed for scenarios where conventional security advice—use strong passwords, enable two-factor authentication, trust your cloud provider—is dangerously insufficient.

The Threat Model: What We Defend Against

High-risk scenarios involve adversaries with capabilities beyond typical cybercriminals. State security services, organized crime syndicates, sophisticated stalkers, corrupt officials, well-funded opposition—these entities have resources, technical expertise, legal authority or willingness to operate outside it, and often the willingness to use physical coercion. Understanding what we defend against and what we cannot defend against establishes realistic expectations.

UnoLock defends against adversaries who seize your devices and conduct forensic examination. When your laptop, phone, or tablet falls into hostile hands, either through confiscation at borders, search warrants, kidnapping, or theft, the attacker gains physical access to storage, memory, and any credentials persisted on the device. Conventional cloud storage services store authentication tokens, cache data locally, or maintain credentials that enable access even without your active participation. UnoLock's architecture ensures that device seizure alone provides the adversary with encrypted blobs that cannot be decrypted without your active participation through PIN entry and server coordination. Even if the device contains the FIDO2 credentials needed for authentication, those credentials cannot be extracted and used without your biometric or physical presence on the actual device.

UnoLock defends against coercion scenarios where violence or threats compel you to unlock your device and provide access to data. The dual-PIN system creates plausible deniability within a single Safe. You mark selected Spaces as sensitive and configure two PINs: your normal PIN, which shows every Space, and a safeword PIN. In the Sovereign tier, the safeword PIN opens the same Safe with the sensitive Spaces hidden, leaving the innocuous Spaces visible—old photos, shopping lists, harmless documents. When someone forces you to unlock your vault, you enter the safeword PIN. They see a vault that appears completely legitimate, with the same interface and authentication flow. The hidden Spaces are not deleted; your normal PIN shows them again. The safeword is no protection against an adversary who already knows what should be in your vault, and it does not hide copies held elsewhere.

In the HighRisk tier, the safeword response is LifeSafe deletion instead. Entering your SafeWord PIN permanently deletes the Spaces you marked as sensitive, while non-sensitive Spaces remain. UnoLock cannot restore them. Even if an attacker later captures you, tortures you, extracts every credential you possess, the deleted data cannot be recovered from your Safe, though copies held elsewhere are not erased. The safeword becomes a dead man's switch. If they force you to that extremity, everyone loses access including you. This changes the economics of coercion. If forcing you might destroy the very data they want, the attack loses its value.

UnoLock defends against harvest-now-decrypt-later attacks where adversaries record encrypted data today to decrypt with quantum computers in twenty years. State intelligence services routinely collect vast quantities of encrypted internet traffic not because they can decrypt it today but because they anticipate future capabilities that will make current encryption obsolete. Every file you upload to Google Drive or Dropbox today encrypted with RSA or elliptic curve cryptography will be readable to anyone with a sufficiently powerful quantum computer in 2045. For high-risk individuals, this temporal vulnerability is existential. The evidence you protect today, the communications you encrypt today, the sources you document today—all of this becomes exposed retroactively when quantum computers mature.

UnoLock uses post-quantum cryptography that resists both classical and quantum attacks. ML-KEM-1024, also known as Kyber, provides quantum-resistant key encapsulation. Dilithium provides quantum-resistant digital signatures. Every session between your client and the server uses these algorithms to establish encryption keys that even a quantum computer cannot derive from intercepted traffic. The data you encrypt in 2025 remains protected in 2045, 2065, 2085. Your decisions today do not create temporal vulnerabilities that expose you or those you protect decades later.

UnoLock defends against malicious cloud providers and compromised infrastructure. You cannot assume Amazon, Google, Microsoft, or any cloud provider remains trustworthy over decades. Governments pressure companies, companies change ownership, economic incentives shift, legal jurisdictions impose different requirements. The architecture ensures that even if AWS administrators with root access to every system examine every database and storage bucket, they find only encrypted blobs. Client-side encryption means data is encrypted before leaving your device. The server never receives plaintext. The cloud never possesses decryption keys. A completely compromised cloud provider still cannot read your data because the cryptographic keys exist only in your control, derived from your FIDO2 credentials and PIN, reconstructed temporarily in browser memory during active sessions, and never transmitted or stored on any server.

What We Cannot Defend Against

Honesty about limitations is critical for high-risk scenarios. UnoLock cannot defend against a completely compromised endpoint device. If malware with kernel-level access infects your operating system before you use UnoLock, that malware can capture your screen, log your keystrokes including PIN entry, extract data from browser memory, and potentially exfiltrate plaintext as you decrypt and view it. No application-level security can overcome a hostile operating system. If you face adversaries with the capability and intent to deploy sophisticated malware against you, you must use dedicated clean devices, potentially running secure operating systems like Qubes OS, and maintain rigorous operational security about which devices access which data.

UnoLock cannot defend against unlimited physical violence. If someone is willing to torture you indefinitely until you provide your normal PIN instead of the safeword PIN, no technology protects you. The duress system creates plausible deniability for scenarios where the adversary has limited information, limited time, or legal constraints. It does not protect against sadistic adversaries with unlimited willingness to inflict pain until they are certain they have obtained everything. At that point, the question becomes not technical but existential—whether you prioritize your survival over data protection, whether you accept destruction of data to prevent its use against others, whether you have external support that can intervene.

UnoLock cannot defend against adversaries who already know what should be in your vault. If someone has prior knowledge of specific documents or files you possess and they do not appear in the vault you unlock, plausible deniability fails. The duress system works when the adversary does not have independent verification of vault contents. It fails when they can prove you are hiding additional data. For this reason, high-risk users must carefully keep plausible content in the Spaces that stay visible that justifies why they have an encrypted vault at all while avoiding content that contradicts their cover story.

UnoLock cannot defend against social engineering that tricks you into providing real credentials willingly. If someone convinces you through deception rather than coercion that they should have access, if they impersonate support personnel or trusted contacts, if they manipulate you into believing that providing credentials serves your interests, the cryptography does not save you. Technical security cannot overcome human psychology. High-risk users must maintain strict operational security, verify identities through pre-established channels, never provide credentials through unexpected requests, and understand that legitimate UnoLock personnel will never ask for your PIN or vault access under any circumstances.

Border Crossing and Device Seizure

Crossing international borders represents a specific high-risk scenario with unique characteristics. Border authorities in many countries claim legal authority to demand device access as a condition of entry. Refusal can result in denial of entry, detention, device confiscation, or even arrest. For journalists, activists, business travelers with sensitive data, or anyone carrying information that authorities might use against them or others, this creates an impossible choice—surrender device access and expose sensitive information, or refuse and face consequences that may include inability to complete your travel or worse.

UnoLock's architecture provides specific capabilities for this scenario. First, no sensitive data needs to exist on the device itself. The UnoLock application is a Progressive Web App that can be installed on any device with a modern browser. The encrypted vault data resides in cloud storage, not on the device. When you approach a border crossing, you can uninstall the application, clear browser data, and factory reset the device if needed. The device becomes clean, containing nothing sensitive. After crossing, you reinstall UnoLock on the same or different device, authenticate with your FIDO2 credentials and PIN, and regain access to your vault. The data never traveled with you physically.

Second, if authorities demand access to your UnoLock vault, you use the safeword PIN. You unlock the device, open UnoLock, and enter the safeword PIN rather than your normal PIN. Your Safe opens with the sensitive Spaces hidden in Sovereign, or deleted in HighRisk, leaving innocuous content visible—travel photos, hotel reservations, contact information that does not compromise your mission. The authorities see you complying, see an encrypted vault functioning normally, and find nothing actionable. Unless they have prior specific knowledge of what should be in your vault, they cannot easily determine that anything is missing. You have complied with their demand for access while protecting actual sensitive information.

Third, the randomized PIN keypad defeats keylogger attacks including those authorities might use. Some border security systems install monitoring software on devices they examine. If you typed your PIN on a standard keyboard, that software could capture it for later use. UnoLock's PIN system presents a randomized grid of hexadecimal characters on screen. You click coordinates rather than typing digits. The positions randomize with every authentication attempt. A keylogger or screen recorder sees you clicking on random positions that correspond to different characters each time. They cannot reconstruct your PIN from this data. Even if they record the entire session, the mapping from click positions to PIN characters remains unknown without the server's matching grid state.

Fourth, the FIDO2 credentials themselves resist extraction. If you use a hardware security key like YubiKey, the private key material never leaves the device. Even with physical access, extracting the key requires sophisticated attacks against the security chip that are beyond the capability of typical border security. If you use platform authenticators like fingerprint or face recognition, those credentials are stored in secure enclaves within the device's processor that similarly resist extraction. An authority examining your device cannot simply copy the credentials to use them later from a different location.

The border crossing protocol for high-risk individuals becomes: before approaching the border, ensure no local copies of sensitive data exist on the device. Ensure the Spaces that stay visible contain plausible content that justifies having an encrypted vault. Ensure you can demonstrate legitimate reasons for using encryption—journalist protecting sources, executive protecting business secrets, lawyer protecting client privilege, activist protecting organizational information. When demanded access, enter the safeword PIN. If they confiscate the device, you lose nothing except the hardware. The vault remains accessible from any replacement device with your credentials.

Protecting Sources and Evidence

Journalists, whistleblowers, human rights investigators, and legal professionals often hold information where exposure would endanger others or where destruction of evidence would allow crimes to continue unpunished. This creates complex requirements. The information must remain absolutely protected against adversaries who want it destroyed or exposed. But it must eventually become accessible to appropriate recipients—editors, legal teams, human rights organizations, courts—under the right conditions. And if you are compromised, arrested, or killed, the information should not die with you.

UnoLock's inheritance feature, LegacyLink, provides cryptographic dead man's switches for this scenario. You configure the vault to automatically transfer access to designated recipients if you do not authenticate within a specified timeframe. If you normally access your vault weekly and you configure a thirty-day dead man's switch, your continued survival and freedom is proven by your continued authentication. If thirty days pass without authentication, the system interprets this as potential death, imprisonment, or incapacitation and initiates the transfer protocol.

The transfer happens cryptographically without requiring any third party to hold keys or information in escrow. The recipient you designate receives access through their own credentials according to the conditions you specified. You might transfer everything to a single trusted editor. You might transfer different Spaces to different recipients based on content sensitivity. You might require multiple timeframes—sixty days for initial transfer to a trusted colleague, one hundred eighty days for transfer to a broader organization, one year for public release. The cryptographic protocol enforces these conditions without requiring trust in intermediaries.

This creates strategic protection. If adversaries know that killing you or imprisoning you will trigger automatic release of evidence to parties they cannot reach, the value proposition of silencing you changes. You become more valuable alive and free than dead or imprisoned. This is not perfect protection—some adversaries act irrationally or prioritize revenge over strategic calculation—but it changes the game theory. The information you protect does not die with you. It becomes more dangerous to them if you disappear.

For source protection specifically, the Spaces feature enables compartmentalization. Each source's information resides in a separate Space with its own encryption and access controls. If one source is compromised or if authorities demand access to information about one story, you can provide access to that specific Space without exposing other sources. The cryptographic separation is complete. Unlocking Space A provides no information about Space B's existence, let alone its contents. This limits the damage from any single exposure.

The duress scenario for source protection involves selective revelation. If forced to provide access, you can unlock Spaces containing less sensitive information or sources who have already been published while keeping the most sensitive sources encrypted. You can keep a visible, non-sensitive Space with source information that is already public or where the source has since relocated to safety. The adversary sees you complying, sees source documentation that appears authentic, but does not gain access to the sources who would be endangered.

The LifeSafe option represents the ultimate protection when source safety outweighs evidence preservation. If the choice becomes revealing sources who will be killed or imprisoned versus destroying evidence that could have achieved justice, some journalists and investigators choose destruction. In a HighRisk Safe, entering the SafeWord PIN permanently deletes the evidence held in Spaces marked as sensitive. No future torture and no cooperation from UnoLock can recover it from the Safe, though copies kept elsewhere are not erased. The sources remain protected. The evidence is gone. This is a terrible choice, but having the capability means you control the decision rather than having it forced upon you.

Cryptocurrency Holdings and Physical Security

High-net-worth cryptocurrency holders face unique physical security threats. Unlike bank account theft which requires social engineering, identity fraud, or account compromise, cryptocurrency theft can be accomplished through physical coercion. The five-dollar wrench attack—beating someone until they transfer cryptocurrency—is not theoretical. Documented cases include home invasions, kidnappings, and targeted attacks against known cryptocurrency holders. The victim cannot call their bank to reverse transactions, cannot rely on fraud protection, cannot recover stolen cryptocurrency through legal recourse. Once private keys are exposed and transactions signed, the theft is irreversible.

Hardware wallets provide partial protection by keeping private keys offline and requiring physical possession of the device to sign transactions. But hardware wallets fail under coercion for the same reason—if someone forces you to use the device and provide the PIN, they can force you to sign transactions that empty your accounts. Hardware wallets also fail at inheritance. If you die unexpectedly, your heirs cannot access the cryptocurrency unless you have shared the recovery seed phrase with them, which creates vulnerability during your lifetime, or unless you trust them with the hardware wallet and PIN, which also creates vulnerability.

UnoLock's approach to cryptocurrency protection addresses both coercion and inheritance. The Digital Paper Wallet feature generates and stores BIP-39 mnemonic phrases with multiple layers of protection. The twenty-four word phrase is split into two twelve-word halves. Each half is encrypted separately using authentication-bound encryption that requires fresh FIDO2 authentication to decrypt. Then the standard Client Data Master Key encryption is applied. Then the Key Encrypting Key layer. Then AWS server-side encryption. This is quadruple encryption where each layer requires different credentials and different cryptographic keys.

To access your cryptocurrency seed phrase, you must authenticate with FIDO2, provide the correct PIN, have the correct device registered, have admin role access rather than read-only, and complete a fresh WebAuthn ceremony that proves your physical presence. Even if someone compromises your device and extracts all stored data, they get encrypted blobs. Even if they compromise the UnoLock server and extract all databases, they get different encrypted blobs. Even if they compromise both, they still need your active participation to decrypt the seed phrase because the authentication-bound encryption requires fresh cryptographic challenges that cannot be replayed.

The duress scenario for cryptocurrency works differently than document protection. You cannot easily populate a decoy wallet with convincing but worthless cryptocurrency addresses. But you can use a two-Space approach: keep a smaller decoy wallet with some funds—enough to be plausible but not enough to represent your actual holdings—in a non-sensitive Space that stays visible, and keep the actual seed phrase for your main holdings in a Space marked as sensitive. In a Sovereign Safe, under coercion, you enter the safeword PIN, the sensitive Space is hidden, you show them the decoy wallet, and they see what appears to be your cryptocurrency holdings without gaining access to the primary wallet.

For sophisticated adversaries who might know approximate amounts you hold, this becomes more complex. They might force you to show blockchain transactions, demand to see wallet balances, or have independent intelligence about your holdings. At that point, the LifeSafe option becomes relevant. In a HighRisk Safe, the SafeWord PIN permanently deletes the sensitive Space holding the real seed phrase. If the choice is between surrendering life-changing wealth to violent criminals who might kill you anyway or destroying the seed phrase so no one benefits, some choose destruction. This is catastrophic for your wealth but removes the incentive for the criminals to continue the attack.

The inheritance feature solves the hardware wallet's fundamental problem. You configure LegacyLink to transfer your cryptocurrency seed phrase to your spouse or adult children if you do not authenticate for ninety days. If you die unexpectedly, after ninety days the system initiates the transfer. Your heirs gain access to the seed phrase through their own credentials. They can import the phrase into any standard cryptocurrency wallet and recover your holdings. No lawyer needs to know the seed phrase. No probate court handles it. No executor holds it in escrow. The cryptographic protocol handles the transfer according to your specified conditions.

This enables safe wealth preservation across generations. You can hold significant cryptocurrency with maximum security during your lifetime—multi-device protection, post-quantum encryption, duress protection, no corporate custody. And you can ensure that your wealth transfers to your heirs after death without requiring you to weaken security during life by sharing credentials or creating copies of the seed phrase that could be stolen, lost, or misused.

Operational Security for High-Risk Usage

Technical capabilities alone provide insufficient protection without rigorous operational security. The strongest encryption fails if you write your PIN on a sticky note, if you register devices you do not control, if you discuss sensitive vault contents over unencrypted channels, if you reuse credentials across services. High-risk users must maintain discipline about how they interact with UnoLock and what information they expose about their usage.

Device registration should follow least-privilege principles. Register only devices you physically control and can secure. Do not register work computers where IT departments have administrative access, shared family devices where others might install malware, or devices in locations where physical security is uncertain. Each registered device creates a potential compromise vector. The Multi-Key feature enables you to register a primary device for regular access, a secondary device secured in a different location as backup, and potentially a hardware security key stored in a safe location as recovery option. But do not over-register. More devices equals more attack surface.

PIN selection requires balancing memorability against resistance to guessing. The randomized keypad means the PIN is never transmitted as typed text, which defeats keyloggers. But if someone observes you entering the PIN visually, they might remember the sequence. For this reason, high-risk users should treat PIN entry as a private act. Do not enter your PIN where surveillance cameras might record you, where bystanders might observe, where compromised devices might capture screen video. Enter the PIN only on trusted networks, preferably over VPN or Tor if you operate in hostile network environments. If you must access a Sovereign Safe from an untrusted location, consider using the safeword PIN intentionally to avoid exposing your normal PIN in that environment; never do this with a HighRisk Safe, where the safeword PIN permanently deletes your sensitive Spaces.

The Spaces that stay visible under the safeword require careful curation to remain plausible. Populate it with content that justifies why you use encryption but contains nothing that would harm you if exposed. Travel documents, work product that is not sensitive, personal photos that are not intimate, contact information for people who are not vulnerable. Avoid content that contradicts your cover story. If you claim to be a tourist but the visible Spaces contain business documents that suggest corporate espionage, this raises suspicion. If you claim to be a journalist but the visible Spaces contain no journalism materials at all, this seems implausible. The visible view should tell a consistent story that explains your use of encryption as normal professional or personal security rather than evidence of criminal activity or subversion.

Regular authentication maintains the LegacyLink dead man's switch and prevents premature transfer. But this creates a vulnerability—the regularity of your authentication pattern reveals something about your operational rhythm. If you always authenticate on Sunday evenings and suddenly stop, this signals a change in your situation. For high-risk users who want to minimize pattern analysis, randomize your authentication times within your configured threshold. If your dead man's switch is set to ninety days, authenticate at random intervals between seven and eighty days. This maintains the switch while avoiding predictable patterns.

Multi-device redundancy protects against single device loss but requires thoughtful distribution. Do not keep all registered devices in the same physical location where a single raid or search could seize them all. Keep one device in your primary location, another in a separate secure location accessible to you, potentially another with a trusted individual who can courier it to you if your primary devices are compromised. Hardware security keys should be stored separately from the devices they authenticate—if your laptop and YubiKey are in the same bag when seized, both are lost simultaneously.

Communication about vault contents should never happen over unencrypted channels. Do not email yourself passwords that you store in UnoLock. Do not discuss specific vault contents in phone calls that might be monitored. Do not store recovery codes or device credentials in locations linked to your identity. The vault's security is absolute but only for content inside the vault. Metadata about the vault, discussions referencing it, credentials enabling access—these exist outside the cryptographic protection and can be targeted through conventional surveillance.

The decision to use LifeSafe deletion should be made strategically before you are under coercion. Decide in advance what circumstances would justify destroying data rather than exposing it. Decide what the threshold is—certain death, likely death, imprisonment, torture, threats to family. Make this decision while calm and rational, not while experiencing violence. Once you have decided the threshold, you can act decisively when that threshold is crossed rather than hesitating with uncertainty that might lead the adversary to inflict more harm thinking you are holding out.

Geographic and Political Context

The threat landscape varies dramatically by geography and political context. High-risk operational security in Germany differs from high-risk operational security in Saudi Arabia, China, Russia, or Myanmar. Understanding the specific threats in your jurisdiction shapes how you use UnoLock and what precautions you take beyond the technical features.

In jurisdictions with rule of law but aggressive surveillance, the primary threats are legal compulsion, mass surveillance, and targeted wiretapping. Security services operate within legal frameworks but use those frameworks to maximum effect—issuing warrants for device searches, demanding data from service providers, deploying malware under legal authority. For users in these contexts, UnoLock's zero-knowledge architecture provides protection because the company cannot comply with demands to decrypt user data even under legal compulsion. The mathematical structure of the system makes compliance impossible. But device security remains critical because authorities can still seize devices and attempt forensic extraction or deploy malware.

In authoritarian jurisdictions with minimal legal constraints, threats include arbitrary detention, torture, extrajudicial killing, and surveillance without oversight. Security services may not request data through legal process but simply seize devices, compel disclosure through violence, or disappear people who resist. For users in these contexts, the duress protection features become essential. The assumption is that eventually someone with guns and no accountability will demand access. The only question is whether you can provide access that appears to comply while protecting critical information. The dual-PIN system provides exactly this capability.

In conflict zones and failed states, threats are less centralized but potentially more violent. Armed groups, militias, criminal organizations, corrupt officials—any of these might target you if they believe you possess valuable information or cryptocurrency. These actors often lack sophisticated technical capabilities but compensate with willingness to use extreme violence. They will not attempt subtle forensic examination of encrypted devices. They will beat you until you provide working credentials. For this context, the visible Spaces must contain enough plausible value that the adversary believes they have succeeded without being so valuable that they intensify violence to extract more.

Border security varies by country and can change rapidly based on political conditions. Some borders conduct routine device searches requiring minimal justification. Others target specific categories of travelers—journalists, activists, nationals of hostile countries, people traveling from conflict zones. Some borders use sophisticated malware to compromise devices. Others perform manual examination looking for obvious red flags. Understanding the likely border threat in your travel context shapes whether you should travel with clean devices and access vaults only after entry, whether your visible Spaces need specific content types, whether you should avoid carrying any devices at all.

Digital surveillance laws affect what protections apply and what legal risks you face for using encryption. In some jurisdictions, encryption is protected as normal security practice. In others, encryption is viewed with suspicion and might be treated as evidence of criminal intent. In extreme cases, refusing to decrypt on demand is itself a crime potentially carrying prison sentences. High-risk users must understand their legal context and decide whether the protection encryption provides outweighs the legal jeopardy using it might create. For some, the answer is that the information must remain protected regardless of personal legal risk. For others, the calculation differs.

The persistence of data creates transnational risk. You might configure your vault in a safe jurisdiction but later travel to or be extradited to a hostile jurisdiction. The decisions you make about what to encrypt, what dead man's switches to configure, what Space access to grant others—these have consequences that persist across borders and across time. Think carefully about jurisdictional risk and data persistence. Deleting sensitive data before traveling to high-risk locations might be prudent. Using temporary Spaces for information that should not persist long-term might be appropriate.

When Technology Is Insufficient

This document must acknowledge the limits of technical solutions. Some threats cannot be mitigated through cryptography or architecture. Some adversaries cannot be deterred or defeated through better security. Some situations require abandoning digital tools entirely and reverting to analog methods that are less convenient but more appropriate for the threat level.

If you face adversaries with unlimited resources and willingness to use unlimited violence against you personally and everyone connected to you, no vault protects you. At that level of threat, using any digital system creates risk. The devices you use can be compromised before you obtain them. The networks you connect to can be monitored in real time. The people you communicate with can be targeted to get to you. Physical surveillance can determine when and where you access sensitive information even if they cannot read the information itself.

For maximum operational security against such threats, consider whether you need digital storage at all. Air-gapped devices never connected to networks. Data stored on encrypted USB drives kept in physically secure locations. One-time pads for critical communications. Dead drops and in-person meetings rather than digital coordination. These methods are far less convenient but far more resistant to technical compromise. UnoLock provides extraordinary protection within the realm of connected digital systems, but it remains a connected digital system with all the attendant risks.

The psychological toll of high-risk operational security deserves acknowledgment. Maintaining perfect security discipline indefinitely is exhausting. The paranoia necessary to avoid compromise can bleed into healthy relationships and mental health. The isolation required for true operational security can make you vulnerable to burnout, depression, and impaired judgment. No technical system addresses this human dimension. If you operate under high-risk conditions long-term, build support networks, maintain psychological health, and recognize when the threat level justifies extreme measures versus when it allows for some measured risk to preserve your humanity.

Exit strategies matter. If the situation becomes untenable, if the threat exceeds what operational security can mitigate, if continuing means certain exposure or death, having plans to destroy evidence and escape is critical. UnoLock's LifeSafe deletion provides the evidence destruction component. You must provide the escape component. This might mean pre-positioned funds in accessible jurisdictions, documentation for alternate identities, contacts in countries that do not extradite, or simply the willingness to walk away from everything when survival requires it.

The decision to accept risk must be conscious and intentional. Some information is worth dying for. Some sources must be protected at any cost. Some evidence must survive you to achieve justice. These are moral choices beyond the scope of technical documentation. UnoLock provides tools. You provide the judgment about when to use them, how to use them, and what outcomes justify what risks. This document cannot make those decisions for you. It can only describe capabilities and limitations so you can make informed choices.

Conclusion: Sovereignty Under Maximum Threat

High-risk individuals face adversaries who can deploy violence, legal authority, technical sophistication, and unlimited resources against them. Conventional security advice designed for normal threat levels provides false comfort in these contexts. High-risk scenarios require architecture specifically designed for coercion resistance, plausible deniability, cryptographic destruction, and protection that survives device seizure, forensic examination, and temporal attacks.

UnoLock's high-risk features—safeword protection that hides (Sovereign) or permanently deletes (HighRisk) marked Spaces, post-quantum encryption, authentication-bound key splitting, dead man's switch inheritance, multi-Space compartmentalization—address specific threats documented in real-world attacks against journalists, dissidents, cryptocurrency holders, and others who operate in dangerous contexts.

But tools are insufficient without operational discipline, threat modeling appropriate to your specific context, and recognition of when technical solutions become inadequate and other strategies become necessary. This document provides technical capabilities and operational guidance. Your judgment, your situation, and your values determine how to deploy them.

The core principle remains: digital existence under threat requires infrastructure that enables sovereignty even when adversaries have physical access, legal authority, and willingness to use violence. Zero-knowledge architecture means no one can compel the service to decrypt your data. Three-party consent means device seizure alone provides no access. Duress protection means coercion can be met with plausible compliance that reveals nothing. LifeSafe deletion means you control whether the data you marked as sensitive exists or is gone.

These capabilities exist because some people face threats where they are necessary. If you face such threats, you now have tools designed specifically for your reality. Use them with wisdom, maintain operational security, and understand both their power and their limits. Sovereignty under maximum threat is possible. This is the infrastructure that enables it.