Digital Records & Password Dependencies

A collectibles estate file is only useful when an authorised person can find it, understand it and recover the records it references. The objects may be physically visible, yet their identity, ownership, provenance, condition history and market significance can remain trapped inside a phone, computer, cloud account, email inbox, password manager or specialist collecting platform.

The planning question is therefore not simply where the passwords are. It is which information would be lost if the collector's digital systems became inaccessible, which dependencies control access, and how a properly authorised person can recover the necessary records without weakening security during the collector's lifetime.

Core collector principle

No essential part of a collection should depend exclusively on one person's memory, one password, one phone, one cloud account, one proprietary application, one subscription, one encrypted device or one untested backup.

The collection has a physical layer and a digital layer

The physical layer includes the objects, packaging, certificates, handwritten notes, cabinets, storage boxes, spare parts, restoration materials and keys. The digital layer may contain the only complete inventory, the evidence that distinguishes an ordinary copy from a scarce variant, or the records proving that an object is borrowed, consigned, jointly owned or already promised to another person.

Inventory

Collection-management records

The master inventory, spreadsheet, database, collection platform, private catalogue, notes workspace or custom system that identifies the objects and records their status.

Evidence

Photographs and ownership records

Images, invoices, auction statements, payment confirmations, certificates, customs records and correspondence that establish appearance, possession, acquisition and title.

Meaning

Provenance and research

Previous-owner histories, expert opinions, saved listings, comparison notes, authentication discussions and annotations explaining why a variant or association matters.

Administration

Valuation, insurance and disposal records

Appraisals, insurance schedules, historic estimates, active consignments, draft listings, buyer enquiries, reserves and records of promised first refusal.

Collector scenario: 500 objects, but no usable interpretation

An executor finds hundreds of similar books, miniatures, cards or boxed games. The objects are present, but the collector's database is the only source that separates first printings from later printings, originals from reproductions, complete sets from assembled sets, genuine signatures from unverified ones and collection property from material held for other people.

Without the digital layer, the estate does not merely lose convenience. It may lose value, evidence, ownership distinctions and the ability to make responsible decisions.

Digital records are not the same as digital assets

Digital record

Information about the collection

Inventories, photographs, emails, invoices, valuations, research notes and records needed to understand or administer physical objects.

Digital asset or right

Property or value in digital form

Cryptoassets, token-linked collectibles, valuable domains, monetised content, intellectual-property rights, platform balances or transferable digital property.

Boundary: access, ownership and transfer are separate questions

An account can contain estate information without itself being transferable. A person may have legal authority over estate property but no technical means to decrypt it. Conversely, knowing a password may make login technically possible without making the login authorised, contractually permitted or appropriate.

Record separately: the information needed to administer the collection, the accounts that hold it, any independently valuable digital property, licences that may end on death, and accounts that should be preserved, memorialised, closed or deleted.

Password dependency is a chain, not a single credential

A collection database may require a laptop password, an account password, access to the collector's email, a code sent to the collector's phone, the phone passcode, continued mobile service, a password-manager master password and a hardware key. Any one of these can become the point at which the entire recovery path fails.

Account dependency

Username, password and recovery email

The visible login may depend on another email account, a password manager or a recovery address controlled by the same collector.

Device dependency

Phone, computer and encryption

A record may be inaccessible without a device PIN, full-disk recovery key, hardware key, biometric fallback or the continued operation of a particular machine.

Second-factor dependency

SMS, authenticator, passkey or security key

Two-factor authentication often survives the password and becomes the real barrier after a phone number is cancelled or a device is reset.

Service dependency

Subscription, domain and provider process

Access can fail when a payment card is cancelled, a personal domain expires, cloud storage is downgraded or a provider requires formal deceased-user documentation.

Diagnostic: common single points of failure

The only inventory sits inside one cloud account.
The master password exists only in the collector's memory.
Backup codes are stored inside the account they are meant to recover.
All two-factor codes arrive on one phone or number.
An encrypted laptop has no documented recovery-key route.
A personal email domain can expire when its payment card is cancelled.
The collection platform may close or restrict access when the subscription lapses.
The only backup is proprietary, obsolete, unlabelled or untested.

Build an access map, not a naked password list

The estate file should identify each critical system and explain the authorised route to it. The visible document should provide orientation. It should not expose every live credential to anyone who can open a folder, photograph a page or find the estate papers.

Access-map field	What to record
System or service	Name the platform, software, account or device.
Purpose	Explain which collection records it holds and why they matter.
Authority	State whether it is the master record, a backup, an archive or a working copy.
Account identifier	Record the username, email address or customer reference where appropriate.
Access route	Point to the password manager, sealed instruction, legacy facility or provider process.
Second factor	Identify SMS, authenticator, passkey, security key or recovery-code dependency.
Recovery dependency	Name the recovery email, phone, printed key, trusted contact or controlled custodian.
Data location	Give the folder, workspace, database, device path or physical media location.
Independent export	Record where the latest offline or human-readable copy is held.
Required outcome	Choose preserve, export, transfer, retain temporarily, memorialise, close, delete or refer.
Last checked	Date the entry and the recovery route were last tested.

Use layered access controls

Layer 1

Visible estate-file information

What systems exist, why they matter, who may act, what should happen and where the controlled recovery mechanism is located.

Layer 2

Controlled recovery material

Sealed master-password instructions, emergency-access arrangements, recovery codes, encrypted recovery documents or hardware-key locations.

Layer 3

Provider and legal process

Death certificate, grant or letters of administration where required, identity, will, provider forms and specialist or court authority where necessary.

Technical access does not create legal permission

Ask four separate questions: can the device or account be unlocked; does the person have legal authority to act; does the provider permit access, disclosure or transfer; and should that person see all the private or third-party information exposed by the route? These answers often do not align automatically.

Password managers, two-factor authentication and passkeys

A password manager can simplify succession by centralising credentials, but it can also become the collection's largest single point of failure. Record the provider, account email, emergency-access configuration, waiting period, trusted contact, two-factor recovery route, security-key location and the effect of a lapsed subscription.

Resilient design: keep one recovery factor outside the vault

A vault cannot recover itself when the master-password hint, email password, authenticator, backup codes and emergency instructions all sit inside it.

Separate at least one factor: sealed offline instructions, accepted emergency access, an externally held recovery code, a solicitor-held key or a second securely stored hardware key.

SMS and authenticator applications

Record the mobile provider, number, device location, whether another authorised person is named, which authenticator is used, whether it is cloud-backed and where recovery codes are controlled. Do not assume a mobile number will remain active.

Hardware keys and passkeys

Record the number, make, label, location, protected accounts and PIN dependency of security keys. For passkeys, identify the host device or account, synchronisation status and whether a conventional recovery route remains available.

Devices and encryption: preserve first, investigate second

Computers, phones, tablets, network storage, external drives, cameras, memory cards and old archive machines may hold original evidence. For each critical device, record its description, owner, location, operating system, login method, encryption status, recovery-key route, data role and whether specialist assistance may be needed.

Immediate protection instruction

Do not reset, update, erase, sell, recycle or dispose of any listed device until the collection records have been secured and exported.

Repeated password guesses, factory resets, SIM removal, operating-system changes, remote wipe, incorrect server shutdown or careless unplugging of encrypted storage can destroy evidence or make recovery harder.

Email, domains, cloud storage and subscriptions

The collector's main email account is often the master key for password resets, auction accounts, dealer correspondence, cloud storage, domain registration, insurance, payments and subscription renewals. It may also contain the only evidence of pending purchases, unpaid invoices, consignments, disputes, returns and authenticity concerns.

Identify the recovery hub

Record primary and collection-specific addresses, old recovery addresses and whether the account should be preserved, exported or closed.

Domain

Prevent the address from disappearing

Record the registrar, domain, renewal date, payment source, hosting provider and transfer or retention instructions for domain-based email.

Cloud and subscription

Preserve before cancelling

Record folder paths, local synchronisation, renewal dates, non-payment consequences, export location and provider deceased-user procedure.

Subscription action hierarchy

Preserve immediately

Services holding the master inventory, photographs, provenance, domains or recovery email.

Maintain temporarily

Services needed while the collection is being secured, valued, marketed or sold.

Export and close

Accounts whose useful records can be preserved before the service is ended.

Cancel promptly

Services unrelated to collection administration or carrying avoidable cost after evidence is secured.

Collection-platform resilience and record hierarchy

A specialist collection platform may be the estate's most valuable digital resource. The estate file should state the account owner, subscription, collection names, export formats, last export date, support route, data included and whether ownership can be transferred. It should also identify which source is authoritative.

Example record hierarchy

Master inventory: the live collection platform.
Current evidence archive: the organised cloud folder.
Emergency export: a dated independent copy on controlled media.
Historic spreadsheet: retained for audit, not current decision-making.
Paper locator: an orientation document, not the master record.

Good file structure

Use stable folders for inventory exports, acquisition records, provenance, valuations, photographs, loans, disposal instructions and access maps.

Stable item identifiers should connect filenames, inventory entries, physical labels and storage locations.

Weak file structure

Names such as IMG_8472.jpg, rare-one-final.pdf or collection-final-new.xlsxrely on the collector's memory.

They preserve files without preserving meaning, status or the link to a physical object.

Backup for estate resilience

Ordinary backup planning protects against hardware failure. Estate resilience must also protect against the loss of the collector's knowledge, credentials and ability to explain the system.

Live working copy

The system used in normal collecting practice.

Independent backup

A copy not controlled by the same account, device or password chain.

Human-readable export

A summary an executor can open without the specialist application.

Off-site or controlled copy

A copy stored separately from the collection premises and main equipment.

Recovery instructions

Enough information to decrypt, open and interpret the backup safely.

Tested restoration

Evidence that the files can actually be recovered and are complete.

A backup is not resilient merely because it exists

It fails when it is encrypted with an unknown password, unlabelled, dependent on discontinued software, never tested, incomplete, corrupted or stored beside the only computer and the collection in the same fire or theft risk.

Privacy, third-party information and account boundaries

Collection records can contain seller addresses, buyer details, private messages, dealer margins, authenticity disputes, family information, bank references and photographs taken inside other people's homes. The estate may need selected collection evidence; it does not necessarily need to disclose the collector's entire digital life to an auction house, dealer or family member.

Evidence

What must be retained?

Preserve what establishes ownership, provenance, value, liabilities, transactions and third-party interests.

Meaning

Who genuinely needs it?

Distinguish the executor, collection adviser, valuer, dealer and family member rather than granting one person unrestricted access.

Collector risk

What should remain restricted?

Segregate private family material, confidential third-party correspondence, banking credentials, work records and unrelated personal data.

Boundary: accounts owned by employers, businesses, clubs or other people

Do not instruct an executor to access an account the collector did not personally own or had no authority to transfer. Identify personal, joint, business, club, work and client systems separately. Legitimate personal collection records should be moved into an appropriate personal archive during life, subject to policy and law.

Marketplaces, communities, loans and consignments

Auction, marketplace, social-media and forum accounts may hold active listings, buyer funds, returns, unresolved disputes, consignment details, provenance conversations, expert identifications and evidence connecting a pseudonym to the collector. Immediate closure can make these matters harder to resolve, while continuing to impersonate the deceased may be inappropriate or prohibited.

Priority check: third-party property and unfinished transactions

Items borrowed by the collector or loaned to others.
Objects held by restorers, framers, auction houses or dealers.
Jointly owned, fractional, club or society property.
Goods sold but not shipped, returns in transit or purchases not yet received.
Active listings, automatic offers, deposits, balances and cancellation obligations.

Myth versus reality

Myth

My family knows my computer password, so everything is covered.

Reality

Encryption, two-factor authentication, missing recovery keys, provider restrictions and unclear authority may still block access.

Myth

Everything is in the cloud, so it cannot be lost.

Reality

Cloud records remain dependent on accounts, payment, retention rules, recovery routes and provider continuity.

Myth

I should print every password.

Reality

A full credential list creates serious security and privacy exposure and may be obsolete when needed.

Myth

My executor automatically receives every account.

Reality

Disclosure, access, deletion, memorialisation and transfer are different outcomes governed by provider process and law.

Myth

Photos prove everything.

Reality

A photograph may show possession or condition but not ownership, authenticity, completeness, date or lawful acquisition.

Myth

Deleting accounts immediately protects privacy.

Reality

Premature deletion can destroy provenance, transaction records, evidence and recovery routes.

Practical action hierarchy

Identify critical records

List the systems without which the collection cannot be understood, protected, valued or administered. Begin with the master inventory, image archive, acquisition evidence, provenance, insurance, valuations, loans and consignments.

Map every dependency

For each system, trace the password, email, second factor, device, recovery key, subscription, domain and trusted-contact chain. The objective is to reveal the hidden point at which access would fail.

Remove single points of failure

Create at least one recovery route that does not depend on the collector's memory, main phone, principal email account or only copy of a hardware key.

Create independent, readable exports

Keep a dated export that can be opened without the original platform. Structured data, human-readable summaries, ordinary image files and a plain-language readme are often more useful than a proprietary backup alone.

Separate access from authority

State who may use each recovery route, when that authority becomes effective and when a provider, solicitor or personal representative must be involved.

Protect sensitive material

Keep master passwords, recovery codes, private keys, financial credentials and confidential correspondence under stronger controls than the general estate-file locator.

Configure legacy facilities

Where relevant, configure provider legacy contacts, inactive-account arrangements and password-manager emergency access during life, then record what each facility actually grants.

Test and review

Confirm that the nominated person can locate the inventory, identify the current export and explain the recovery route without receiving unrestricted access while the collector is alive.

Suggested estate-file section

Digital records overview

Primary collection system and purpose.
Authoritative record and last verification date.
Primary export location, format and date.
Photographic, acquisition, provenance, valuation and insurance archives.

Access dependencies

Primary account email or identifier.
Password-management and controlled recovery method.
Second-factor type and recovery route.
Critical devices, encryption recovery and emergency contact.

Immediate instructions

Do not erase, reset, sell or update listed devices.
Do not cancel critical subscriptions before export.
Confirm legal authority before using access routes.
Preserve active transactions, loans and consignments.

Required outcomes and restrictions

Preserve, export, transfer, retain, memorialise, close, delete or refer.
Identify private family, third-party, financial and work-related material.
State which records must not be disclosed to dealers or auction houses.
Name the specialist to contact when recovery fails.

Digital-access checklist

Discovery

✓Every critical digital system is named.
✓The authoritative inventory is clearly identified.
✓Historic and superseded copies are marked.
✓Important devices and storage media are physically locatable.

Access

✓A recovery route exists outside the collector's memory.
✓Two-factor and passkey dependencies are documented.
✓Encryption recovery instructions are controlled and locatable.
✓Hardware security keys are labelled and their purpose is explained.

Preservation

✓A recent independent export exists.
✓The export opens in ordinary, available software.
✓Images and supporting documents are included or clearly linked.
✓At least one copy is stored away from the main device and collection premises.

Interpretation

✓Stable item identifiers connect records to physical objects.
✓Custom abbreviations, condition grades and field meanings are explained.
✓Owned, borrowed, consigned and jointly owned items are distinguished.
✓Priority, sensitive and specialist-handling items are flagged.

Security and administration

✓Live credentials are kept out of the openly accessible locator.
✓Work, business, club and personal accounts are separated.
✓Critical subscriptions and domains are marked for temporary preservation.
✓Provider procedures, active transactions and specialist contacts are recorded.

Maintenance

✓The digital section is dated and versioned.
✓The nominated people remain willing and appropriate.
✓Recent device, password, phone, email and platform changes are reflected.
✓The recovery route has been tested without exposing live credentials.

When specialist assistance is justified

The specialist threshold should be crossed early when experimentation could destroy data, expose private information or compromise evidence. Depending on the issue, the right adviser may be a solicitor, digital-forensics professional, cyber-security specialist, accountant or specialist collection adviser.

Cryptoassets, seed phrases, private keys or token-linked collectibles are involved.
Devices or backups are encrypted and the recovery route is uncertain.
The collector operated as a dealer or held third-party goods.
Active sales, consignments, disputes or ownership claims remain unresolved.
The records contain substantial personal, business, regulated or confidential information.
The collection platform is custom-built, obsolete or dependent on specialist software.
Access may breach provider terms or interfere with evidence needed for tax, insurance or litigation.
Family members disagree about who should access the records or what should be disclosed.

Key takeaways

The estate file should map systems and recovery dependencies rather than publish every password.
Technical access, legal authority, provider permission and confidentiality are separate controls.
Email, phones, domains, second factors and subscriptions often matter more than the visible password.
Independent, human-readable exports protect the collection from platform and credential failure.
Devices and accounts should be preserved before they are reset, cancelled, reorganised or closed.
Sensitive credentials and unrelated private material require stronger separation than the general locator.
A controlled test is the only reliable way to expose a hidden single point of failure.

Continue learning

Valuation & Disposal Guidance

Record how the collection should be valued, marketed and disposed of without forcing executors to improvise.

→

Back to Preparing an Estate File

Return to the full estate-file sequence and its collector-focused planning topics.

→

Review, Updates & Version Control

Keep the estate file current, identifiable and trustworthy as the collection and its systems change.

→