perlatumEngineering trust across time
You leave a message for someone to open in 2076.
The service closes in 2046. Who delivers it now?
Perlatum is researching how the person you chose could find your message, verify that you wrote it and open it on your terms, even if Perlatum itself is gone.
Thought experiment
You can hand a letter to a friend today. Then someone has to keep it safe, find the right person and remember when to give it to them. You can schedule an email, but who will own that inbox decades from now? Imagine leaving one message to cross that distance.
2026
Your daughter is six. You write down why you made a decision that shaped her childhood. You want her to have your own account in 2076, when you may no longer be there to answer her questions.
Count fifty years back from 2026. In 1976, the first web server was fourteen years away. Gmail was twenty-eight years away. Now look the same distance forward.
2046
The login stops working. The team disperses. If the original service alone was scheduled to send your message, delivery stops here. A backup might still hold every word.
Thirty years from now, no reminder will come from that service. What would your daughter need outside the company to find the message and open it on your terms?
2076
Your daughter is now fifty-six. Her surname has changed. Her childhood inbox is gone. Among the family papers she finds instructions for a sealed message. Where can she find the copy, and how can she prove it was meant for her?
Even if she finds it, she needs a way to check that these are your words and that you never withdrew permission. That is what the research has to make possible.
Your daughter has kept a sealed copy for decades. The design gives her a reader she can run on her own device. If you cancelled the message after she saved it, how would that reader know?
In a local simulation, we switched off the company service. A separate reader compared a portable test message with a trusted record of the sender’s latest instructions. It recovered the original text and rejected both an altered copy and an out-of-date one.
We supplied the trusted record ourselves. After a real shutdown, your daughter would need a way to find that record and verify that it was still current. A full recovery drill with the operator offline is still ahead.
We’re starting with text. The initial design lets a sender choose a future date or a defined period of inactivity with check-ins, warnings and a grace period. Audio and video are longer-term goals.
The proposed experience
Choose the person and the rule. The design encrypts the message on the sender’s device.
Choose one person or several. Decide who should receive each message. The design calls for encryption on your device before a copy leaves it.
Choose a date or an inactivity rule. Review the people, the condition and what happens if you lose access. Once sealed, the words are fixed. A revision needs a new version.
Save the recovery materials and protect your credentials. You may need them to confirm activity or cancel. A cancellation must take effect before release is authorized. After that, a message cannot be recalled.
An advance notice could let you prepare even if you have never had a Perlatum account. You could keep the encrypted copy and instructions, and protect your private credentials separately. Early notice gives you no early access.
Years later, a lost phone or old address may leave you unable to sign in. The recovery design must let you prove you are the person originally named. Someone who helps you recover access does not inherit your right to read.
The design checks your identity and device before you can open the message locally and verify its origin and contents. Each recipient does this separately. If the operator has closed, its notices may have stopped. Independent recovery also needs surviving instructions, evidence and key holders.
Release conditions
The sender chooses one of two rules in the initial design. Each sets the earliest point at which release can be authorized. The person named in the message still has to establish their own access.
“Let my daughter read this on 12 November 2076.”
The message stays sealed until the chosen date and for at least seven full days after preservation is acknowledged. Both requirements must be met. This route has no quarterly check-in.
When the date arrives, the system must still verify the sender’s current instructions, check the message’s integrity and resolve any hold. An earlier cancellation can keep a surviving copy sealed.
“If I stop confirming that I’m here, give me time to respond before considering release.”
The sender is due to confirm every three calendar months. A missed confirmation starts a 30-day grace period with warnings. A valid confirmation resets the three-month clock if it takes effect before release.
If there is no qualifying evidence that the final warning reached a previously verified contact route, the message stays on hold, potentially indefinitely. An outage affecting the required services also pauses the process. Once service is verified and the process restarts, a fresh grace period and warnings follow.
Even after the grace period, the seven-day minimum and final checks still apply. Inactivity records missed confirmations. It cannot establish death, incapacity or disappearance.
Try the inactivity rule
The message stays sealed. The next confirmation is due three calendar months after the last accepted one.
A known wedding date can use the date rule. Establishing that a wedding actually took place, giving an executor authority to trigger release, or combining a date with inactivity would each require a different design. Those options are outside the first product’s scope.
Possible applications
Some of these situations fit the initial text-message design. Others ask more of it, especially when someone’s safety, legal authority or a changing institutional role is involved.
Keeping the file is one part of the work. The recipient also needs a way to establish whose words they are and when they may be read.
Someone may need to keep a copy safe for decades. What prevents that person from reading it?
How can a recipient verify who wrote the message and whether the words have changed?
What if the sender cancelled the message years ago, but an older copy still exists?
Which records, people and tools must survive for recovery to work without Perlatum?
The name
Perlatum comes from the Latin perferre, to carry something all the way to its destination. For a message, that journey ends with the person it was meant for.
Research preview
Would you like to try recovering a sample message with the company service switched off? Leave your email for an invitation if the experiment opens to participants.
We’ll use your email only for research preview invitations. To withdraw your request, write to mail@perlatum.org. Privacy notice.We welcome conversations with researchers, infrastructure teams and strategic partners interested in testing what it takes for a private message to outlive its original operator.