Product principles

Status: Accepted · Version: 0.1

These five principles are the headline engineering contract for every Titip repository. TITIP-001 makes them normative. A feature that violates one of them is out of scope, even if it would demo well.

1. Titip records guidance, not secrets

Titip stores instructions that help a person act: which institution to contact, where an original document is kept, who the beneficiary is, what to do about a pet or a small business.

Titip does not store passwords, PINs, recovery phrases, private keys, OTPs, CVVs, or other authentication secrets. It is not a password manager.

Allowed:

Institution: Bank ABC. Account type: Savings. Instruction: I have an account with Bank ABC. Contact their deceased-estate team. The original supporting documents are stored in…

Prohibited:

PIN: 123456. Password: …. Seed phrase: ….

The prohibited set is canonical in ADR-002 and policies/security.md.

2. Silence alone never means release

A missed check-in is not a determination that someone has died, and it is not by itself permission to release anything.

Life check is a state machine: reminders, an alternate channel, a grace period, trusted-contact verification, and — before any real release — manual review. At any state, the owner confirming they are present returns the cycle to active.

The first product version does not fully automate release. See ADR-004 and ADR-005.

3. Every recipient only sees what was explicitly assigned to them

A wife, a business partner, and a child are not interchangeable viewers of one account. Each recipient receives only the vaults assigned to them, and only after the release rules for that assignment are satisfied.

Recipient access is not account access. An email or WhatsApp message never contains vault contents. It may only say that Titip information is available, behind a short-lived, single-purpose, revocable, recipient-bound link.

4. Release decisions must be explainable from auditable evidence

Someone must be able to answer, from records rather than memory:

• Who changed the release policy, and when?
• Who added a trusted contact?
• Which life-check notifications were sent, and did the provider accept them?
• Who verified the trusted contact?
• Why did a case become eligible?
• Who approved the release?
• Exactly what information was delivered, and when did the recipient access it?

Rules are versioned. Editing a rule archives the old version and activates a new one. In-flight cycles keep the version that was active when they started.

5. AI may assist preparation, but never decide whether someone is dead, inactive, or eligible for release

AI helps an active owner discover what to document and draft instructions the owner then reviews. It does not declare death, inactivity, or release eligibility. It does not ask for secrets. It does not pretend to be a notary, lawyer, or estate executor.

See TITIP-012 and policies/ai-safety.md.