What Happens If a Dead Man's Switch Fires by Mistake?
You're four days into a trek with no signal. Your phone is in a hospital locker with the rest of your clothes. Or, the likeliest one, you switched handsets last month and never turned notifications back on. Somewhere in the background, a service you set up in a thoughtful mood is counting the silence and deciding what it means. That's the fear that stops people setting one of these up at all. Not that it fails, but that it fires while you're completely fine, and lands with the people you'd least want to explain it to.
Why most services get this wrong
A dead man's switch works by inferring something enormous from something small: that no answer means no person. That inference is wrong far more often than it's right.
A misfire is rarely a bug. It's usually a design that treats one signal as sufficient.
A single deadline
You pick a date, and if you haven't logged in by then, everything goes out. The system draws no distinction between "died" and "did not open the laptop". A missed login is a missed login.
A single channel
The service emails you. If that email lands in spam, or you changed addresses, or a provider throttled the sender, the check-in you never saw counts against you exactly like the one you ignored. You're being tested on a message you were never shown.
No human in the loop
The decision to tell someone's family they're probably dead gets made by a scheduler, on the strength of an unanswered email.
When you're weighing up one of these products, count how many independent things have to go wrong before delivery happens. That number is the only honest measure of how safe a switch is. If it's one, you don't have a safety system. You have a timer with a good story.
What stands between silence and a delivery
Four things have to go wrong before you get here. Six, if you turned the other two on.
Missing one check-in does nothing
Delivery needs several consecutive misses. The default is three, you choose the number, and you get a fresh reminder at every step. A single ignored notification moves a counter and nothing else.
Opening the app is enough
Using Sanctia at all counts as a check-in, so most weeks you'll never do anything deliberate about it.
Nothing moves the moment the final check-in goes unanswered
There's a hold first. It defaults to 24 hours, and you can extend it.
Pause whenever you need to
Surgery, a long trip, a hard month. A week, three months, or until you lift it. A timed pause resumes on its own. An indefinite one waits for you, so pick a length if you would rather not have to remember.
A second way to reach you
Check-ins go out by email on a new account. Add push and SMS in settings, so a spam filter is never the only thing between you and a false alarm. SMS needs a phone number you've added and verified.
A person can veto it
You can name a trusted contact who has to confirm before anything is sent. While that request is open, your account pauses itself and delivery cannot proceed. Your contact gets two buttons, "Confirm: send their messages" and "They're okay, don't send", and the second resets your account to active as though nothing happened. You choose how long they get, up to 30 days, or you can set the request to wait indefinitely for an answer. It's off until you switch it on, and naming a contact does not switch it on.
Even after they confirm, delivery waits an hour. Either of you can still stop it inside that hour, which is there for the case where someone taps confirm and then the phone rings.
Two caveats.
Silence from your trusted contact is not a veto. If you set a confirmation window and it expires with nobody answering, delivery proceeds. The veto needs someone to act. If you want silence to mean "wait", set the window to have no limit.
And once a confirmation request is in flight, passively opening the app is no longer enough. At that point you need the explicit "I'm okay" action. That's deliberate. An unlocked phone in someone else's hands pings the server perfectly well, so an automatic signal proves nothing once a real question has been raised.
Check-in intervals run from a day to a year. The encryption model is written up in full on the security page.
There is no recall
Once your messages have been delivered, Sanctia cannot pull them back, and neither can you. If you return to a triggered account, you can reset it. That clears the counters and resumes check-in monitoring. The dialog says it too: messages already sent to your recipients cannot be recalled. Reset restores the switch. It does not undo the delivery.
Recall isn't a feature we've skipped. Recipients get a link to their own private vault by default, rather than an email carrying the message body. By the time you could ask for anything back, the notification has landed and, in most cases, been read. Deleting the content afterwards wouldn't delete the fact that someone was told. If a service promises to un-send a message like this, it's describing an email client.
The recipient's side of it matters too, because that's the part you'd be apologizing for. They didn't know they were a recipient. Nobody warned them, by design. They get a link, they open a vault, and they find a message from you written for a moment that hasn't arrived. If you put a passphrase on the message, the contents stay locked until someone enters it, so what they see depends on what you've already given them. Don't plan around that. It's how the encryption works, and it won't save you from a false alarm.
Everything upstream of delivery can be undone. Delivery can't. So when you compare products, weigh the prevention heavily and discount anything offered as a remedy afterwards.
Questions to ask any service
Take this list to whichever product you're evaluating, including this one. The answers are more revealing than any feature grid.
- How many consecutive check-ins can I miss before anything is sent, and can I set that number myself?
- How many channels will you use to reach me? What happens if one of them fails silently?
- Can a human being stop a delivery? Who, and how long do they have to respond?
- If that person never replies, does the silence stop delivery or allow it? Ask this one explicitly. It's the most common gap.
- Is there a waiting period between my final missed check-in and delivery?
- Can I pause? Does the pause expire on its own, or can I leave myself unprotected by forgetting?
- What counts as a check-in? Does opening the app count, or only clicking a link in an email?
- Can anything be recalled after delivery? Get a straight yes or no, in writing.
- What do recipients see, and did they know in advance that they were recipients?
If you cannot get a clear answer to questions 4 and 8, treat both as a no and price the risk accordingly. We keep a comparison of the main options, and a guide for people moving away from a service they already use.
All nine questions have answers here, and you can check them before you write a word.
Sanctia is in early access. The web app is open to anyone today, the iPhone app comes through Apple's TestFlight, and Android is in open testing on Google Play.
Free during early access. No card, no phone number. Four minutes to set up, and you can delete your account whenever you want.