Digitising records solves two problems at once: it produces a copy that survives the loss of the original, and it makes a filing cabinet portable enough to fit in a pocket or leave with a relative.
It also introduces two new failure modes that paper does not have, which are that a digital copy can be silently corrupted and that it can be locked away behind a password nobody else knows. Both are avoidable and both catch people out.
Three, two, one
The off-site copy is the one people skip and the one that matters. A fire or a flood destroys the original and the backup together if they are in the same house, and those are the events this whole page is insuring against.
Off site can be: a relative's house, a friend, a workplace drawer, a bank safe deposit, or an online account. It does not have to be sophisticated. A memory stick at your sister's is a valid off-site backup.
Sync is not backup
The distinction that trips up almost everybody who thinks they are covered.
A synchronisation service keeps copies identical. That means that if a file is deleted, corrupted, or encrypted by ransomware on one device, the same thing propagates to every other copy, promptly and automatically.
A backup is a separate copy that does not change when the original does.
- Use sync for convenience, and do not count it as your backup.
- Keep at least one copy that is disconnected: a drive or a stick that is not plugged in, or a service with genuine versioning and a long retention period.
- Check whether your cloud service keeps old versions, and for how long. Many do, and the retention period is often shorter than people assume.
The disconnected copy also protects against you, which is the commonest cause of data loss: deleting the wrong folder and not noticing for six months.
What to scan and how
Everything from the documents list, plus the things that are not documents.
- A phone camera is good enough. A dedicated scanner is nicer and unnecessary. Use a scanning app that flattens and crops the page.
- Good light, flat, square on, and check it is legible before you move to the next page. An unreadable scan of a certificate is worse than none, because you think you have it.
- Both sides, wherever there is anything on the back.
- Name files so they can be found: person, document type, date. "Sarah-passport-2029.pdf" beats "IMG_4471.jpg".
- One folder per person, one for the house, one for vehicles, and so on. Simple beats clever.
- Photograph the possessions too. A video walk through the house, opening cupboards, is what an insurance claim needs.
- Scan the photographs. The family albums are the one category where loss is permanent.
Do it in sessions. An hour a week for a month clears most households, and trying to do it all in one go is how it never gets started.
Formats that will still open
A file is only a backup if something can still read it in fifteen years.
- PDF for documents. Widely supported and stable.
- JPEG for photographs, or TIFF or PNG for anything you want at archival quality.
- Plain text for notes and lists. It will outlive every application.
- Avoid proprietary application formats for anything you want to keep long term, and export a PDF copy alongside.
- Avoid anything that requires a specific piece of software or a subscription to open.
Do not compress everything into one enormous encrypted archive unless you are confident about the tooling. A single corrupt block can take the lot, and a format nobody can open in ten years takes it just as effectively.
Where to put the copies
Every medium fails, which is the reason for three copies on two kinds.
Refresh them. Copy onto new media every few years. A memory stick from 2015 in a drawer is not a reliable archive, and this is the maintenance step nobody does.
Label physical media with what it is and the date it was written.
Keep one copy that works with no network at all, which for this app is the point: a memory stick or a drive with the archive on it, in the grab bag, readable on any laptop.
Encryption, and the risk it introduces
Encrypt anything containing identity documents, financial details or medical records, particularly on a portable device. A memory stick with everybody's passports on it is exactly what should not be lost unencrypted.
And understand the risk you have created: a lost passphrase means the data is gone, permanently, with no recovery. There is no support line for this.
- Use a strong passphrase you will not forget.
- Write it down and store it separately, in a sealed envelope with a trusted person, or in a safe. Writing it down is not the security failure people assume, when the threat is losing it rather than a targeted attack.
- Make sure at least one other person can get in, or make sure they have a route to the unencrypted paper equivalent.
- Do not encrypt the only copy.
Consider tiers here too. The truly sensitive material encrypted; the merely useful material, such as insurance policy numbers and utility accounts, left readable so somebody can act in a hurry.
Passwords and emergency access
The modern version of "where are the keys", and most households have not addressed it.
- A password manager, with a strong master password, is the right answer. It removes reused passwords, which is the single biggest practical security improvement most people can make.
- Set up the emergency access feature, which most managers offer: a nominated person who can request access, with a delay during which you can refuse. That is the mechanism that solves this properly.
- Or seal the master password in an envelope with the will, or with a trusted person, and note it on the household index sheet.
- Two factor authentication protects accounts and can lock you out permanently if you lose the device. Print the recovery codes when you set it up and put them with the documents. This is the commonest way people lose access to their own accounts.
- List the accounts that matter on the household index: bank, email, phone provider, energy, insurance. The email account is the master key to most of the others, which is why it deserves the strongest protection.
Think about what happens if you are in hospital for a month. Could somebody pay the bills, reach the insurer, or contact your employer? That is a more likely scenario than any other on this page and it is the one to design for.
The paper layer
Do not let the digital archive replace paper entirely.
Print and keep on paper:
- The household index sheet.
- Insurance policy numbers and emergency claim lines.
- Key phone numbers, including the out-of-area contact. See getting a message out.
- Prescription lists and medical essentials.
- Any two factor recovery codes.
- Bank and utility account references.
Paper needs no power, no device, no password and no format. In the scenario this app is built around, that is the whole argument, and it is why the app itself is designed to work offline.
Testing it
A backup that has never been restored from is a hope.
- Once a year, open the backup on a different device and check that files open and are legible.
- Check the off-site copy is current, which is the commonest failure: it was made three years ago and nothing since is in it.
- Ask the person holding it whether they still have it and can find it.
- Try the emergency access route, or at least confirm the nominated person knows they are nominated.
Put it in the annual review with the documents and the drills.