HomeDocumentsContinuity2026

How to Keep Your Important Documents Usable When the Power, the Cloud, or the House Fails

A cloud-only document is a dependency that fails with the very outage you need it in, and a printed password in a fireproof box is a skeleton key. Here is the three-copy rule, the record-versus-secret split that routes the secrets to the break-glass, the what-you-cannot-replace inventory, and the encrypted-USB-and-printed hybrid — the decommission and survivable-passwords discipline, applied to the paper.

General information only — not legal or financial advice, and not a description of any specific jurisdictions record rules. This page explains the structure of document continuity — the three-copy rule, the record-versus-secret split, the what-you-cannot-replace inventory — in broad terms. Which documents are legally required, how to replace a lost record, whether a scan is accepted as an original, and what a safe-deposit or fireproof rating actually means vary by jurisdiction and institution and change over time; the names, forms, and acceptance rules belong to your national records or identity authority, your insurer, your bank, and a solicitor — not a guide page. And the irreversible failure this page stands against: never print a password, seed phrase, PIN, or private key into the kit — a printed secret in a firebox is a skeleton key, and the secrets go in the break-glass our survivable-passwords guide builds.

Three plain blank paper copies of the same sheet laid in a row — one flat on the surface, one inside a small open fireproof metal box, one beside a plain unmarked USB stick — on a clean light surface — The three blank copies of the same sheet — one flat, one in the open fireproof box, one beside the unmarked USB stick — are the three-copy rule made physical: the same record in three places, so the event that takes one does not take all three. The sheets stay blank on purpose, because the lesson is the redundancy of the structure, not the content of the page, and the cloud copy is the one that fails with the outage you need it in.

Updated September 2026By the AI Help Guide editorial team10 min read

The Dependency That Fails On The Day

The Cloud Copy Is the One That Is Gone When You Need It

The modern instinct is to scan everything to the cloud and consider the matter closed — the documents are "backed up," searchable, and everywhere, so why keep paper? The instinct is reasonable and it is exactly wrong on the day, because the cloud copy is a dependency: it requires power, internet, an account that still opens, and a provider that has not locked or lost the record, and the event that takes the house may take the cloud access too. The flood that empties the home kills the power and the broadband; the evacuation that saves the family leaves the phone behind; the account that was "everywhere" is locked on the day for a reason that will be resolved in a week you do not have. The cloud copy is the one that fails with the very outage you need it in, and a single copy in any one place — a firebox, a drive, or an account — is a single point of failure.

This page is the paper half of the continuity trio; its companions, the emergency-kit guide and the family-communication-plan guide, deal with the stuff and the coordination, and the kits document tier is this page in miniature. The decommission guide that came before explained how to close a device out so it leaks nothing; the survivable-passwords guide explained the inventory and the break-glass for the secrets; this page turns the same discipline onto the records — the paper and the scans that prove who you are, what you own, and what you are owed — and it ends where 60 could not: with the honest limit that a printed secret in the kit is the skeleton-key failure the newspaper test exists to prevent, so the records print and the secrets do not, and the two never merge into one document.

The Three-Copy Rule

On-Site, Offsite, Cloud — and the Limit on Each

The structure is three copies in three places, and the order matters because each copy fails in a different way and the redundancy is the point. The three-copy rule below names what each copy is for and — the part most "back up your documents" advice omits — the specific way each one fails, because a copy you do not understand the failure mode of is a copy you will over-trust.

On-site — the fireproof and waterproof boxThe copy you can reach in the first hours, in the house, in a box rated for both fire and water. This is the copy that survives the event that takes the house but not the street, and it is the one a responder or a relative can open on the day.

Fails how: the event that takes the whole house — a total fire, a flood that reaches the box, a theft — takes this copy with it. On-site is the fastest copy and the most locally fragile.

Offsite — a trusted person or a safe-deposit boxThe copy outside the home, with a relative in another town or in a bank safe-deposit box. This is the copy that survives the event that takes the house and the street, and it is the one that requires no power and no account.

Fails how: it is not reachable in the first hours — you must travel, or the bank must open, or the relative must be reachable. Offsite is the most locally robust and the slowest to reach.

Cloud — the redundant third, never the onlyThe encrypted copy in a provider account, reachable from anywhere, the redundancy that survives both the house and the offsite being gone. This is the copy that is "everywhere" — and the one the page exists to demote from "the plan" to "the third."

Fails how: it requires power, internet, an open account, and a provider that has not locked or lost the record — the exact dependencies the outage removes. Cloud-only is the single point of failure the three-copy rule exists to break.

Copy	Where	Survives	Fails how
On-site	Fireproof + waterproof box	The house, not the street	Total house loss, theft
Offsite	Trusted person / safe-deposit	The house and the street	Not reachable in first hours
Cloud	Encrypted provider account	Both, if access holds	Power, net, account, provider

The tables right-hand column is the pages quiet thesis, because each copy has a distinct failure mode and the redundancy is the point: the on-site copy is fastest and most locally fragile, the offsite copy is most locally robust and slowest to reach, and the cloud copy is everywhere and dependent on the exact infrastructure the outage removes. A single copy in any one place is a single point of failure, and the three-copy rule breaks it by making the three fail differently — so the event that takes one leaves the other two. The discipline is not to pick the "best" copy; it is to hold all three and understand that the cloud copy, the one the modern instinct treats as the plan, is the third, not the first, and it fails with the very outage you need it in.

The record-versus-secret split — the irreversible failure, and the newspaper test that divides them. This is the load-bearing guardrail of the whole page, and it is the line the survivable-passwords guide drew and this page applies to the paper: records print, scan, and encrypt; secrets do not, and the two never merge into one document.

Records — print, scan, encrypt, store in the three copies

Identification — passports, driving licences, birth and marriage certificates
Insurance policies and the claims history
Property deeds, leases, and the mortgage
Medical histories, medication lists, and allergies
Financial statements, tax records, and account references
Wills, powers of attorney, and the inventory of what exists

The newspaper test, applied to the kit: if a stranger reading this line would gain access, it is a secret and it never enters the kit. If a stranger reading it would gain nothing but a fact about you, it is a record and it belongs in the three copies. The dividing line is not sensitivity — a medical record is sensitive and still a record — it is grantability: does reading it open a door, or only describe one?

Secrets — never printed, never in the kit, only in the break-glass

Passwords and the master password
Seed phrases and private keys
PINs, unlock codes, and security-answer values
Full card numbers and CVV
Any string that, read by a stranger, grants entry

The two bands and the test between them are the whole method, and they resolve the tension the survivable-passwords guide named without a compromise: the records are comprehensive and findable precisely because a stranger reading them gains access to nothing, and the secrets are protected precisely because they never enter the kit at all. The failure mode the split prevents is the well-meaning one — a person who prints "everything" into the firebox "so the family has it all in one place," producing a single document that is both the record and the skeleton key, and which, if the box is opened by a responder, a relative, or a thief, hands over every account the secrets protect. The records and the secrets must live apart; the newspaper test is how you keep them apart without thinking about it each time, and the secrets route to the break-glass our survivable-passwords guide builds, never to the kit.

The what-you-cannot-replace inventory — the decommission logic, applied to records

Birth / marriage certificates Deeds / lease Insurance policies Passport / licence Medical history / medication list Will / power of attorney Tax / financial statements Account references (not secrets) Photos / irreplaceable digital Vehicle titles Diplomas / certifications The inventory of what exists

The inventory discipline is the same one our decommission and survivable-passwords guides taught, applied to the paper: you cannot replace what you cannot prove existed, so the first step is the list of what you hold and what you would struggle to recreate. The items marked hot are the ones whose loss means a wait, a fee, or a claim you cannot prove — a birth certificate that takes weeks to reorder, a deed that proves ownership, a policy that proves cover, a passport that proves identity. The last chip — the inventory of what exists — is the meta-record the survivable-passwords guide builds and this page depends on: a single list of what you hold and where the copies are, so the executor or the responder can find the rest. The inventory is the raw material; the three copies are the structure that holds it.

On-site

Fireproof AND waterproofA box rated for both, because the event that burns the papers floods the box, and a fire-rated box that is not water-rated fails in the flood that puts out the fire. Check the rating; a "fire-resistant" tin is not a fireproof box.

Offsite

Trusted person / safe-depositA copy with a relative outside the region, or in a bank safe-deposit box — and know the access rule, because a safe-deposit box can be sealed on death until an executor is appointed, which is the dependency the survivable-passwords guide warns of in another form.

Cloud

Encrypted, redundant thirdThe encrypted copy in a provider account, the third not the first, and reachable from anywhere — but understood to fail with the outage, so it is never the only copy and never the plan.

The three physical boxes are the on-site, offsite, and cloud copies seen from the storage side rather than the failure side, and the discipline each names is the one most people miss. The on-site box must be rated for both fire and water, because the flood that puts out the fire destroys the papers a fire-only box was supposed to save — a rating to check, not assume. The offsite copy must be reachable by the person who will need it, and a safe-deposit box that seals on death until an executor is appointed is the dependency the survivable-passwords guide warns of in another form — so the offsite copy with a trusted person is often more reachable in the first hours than the box at the bank. The cloud copy is the encrypted third, and the encryption is the discipline that makes the cloud acceptable as a record store while the secrets still never enter it — because an encrypted cloud record is a record, and a plaintext cloud secret is a skeleton key in a provider's hands.

The encrypted-USB-and-printed hybrid — the method that makes the copies usable, not just stored. The practical structure that binds the three copies is a hybrid: an encrypted USB drive holding the scanned records, kept in the on-site firebox and duplicated offsite, alongside printed copies of the handful of documents you will actually need in the first hours — identification, insurance, the medical list, the inventory. The reason for the hybrid is that a USB needs a reader and a screen, and a printout needs neither, and the day you need the record is the day the power and the device may be gone; so the encrypted USB is the comprehensive copy and the printout is the reachable one, and you hold both. The discipline that keeps the hybrid honest: the USB is encrypted (a lost unencrypted drive is a record breach), the printout is records only (the newspaper test — no secrets on paper), and the two are stored in the three places, not in one. The hybrid is the method; the three-copy rule is the structure; the newspaper test is the guardrail; and the encrypted USB is the thing that makes the comprehensive copy portable without making it a skeleton key.

The ladder-four dependency — the cloud-only document is the rung that fails with the outage. It is in the cloud, so it is backed up and safe. It is in the cloud, so it is dependent on the exact infrastructure the event removes. This is the same dependency framing our privacy-economics guide applied to telemetry and our survivable-passwords guide applied to the vault: a record that lives only on a service you do not control is a record you do not control, and the service can fail, lock, lose, or vanish on the day you need it. The cloud-only document is the ladder-four rung — convenient, everywhere, and the first thing to go when the power, the network, or the provider does. The three-copy rule exists to demote the cloud from "the plan" to "the third," because the event that takes the house may take the cloud access too, and a single copy in any one place is a single point of failure. The honest posture is the same the survivable-passwords guide took toward the vault: use the cloud as a redundant third, never as the only, and hold the reachable copies — the on-site printout and the offsite duplicate — so the dependency is never the only path to the record.

The review cadence — records expire, and a copy that was right three years ago may be useless today

Passports and licences expire — a copy of an expired passport is a record of a thing that no longer proves anything, so the cadence re-scans and re-prints the current ones.
Policies renew and change — the insurance copy from last year may name the wrong vehicle, the wrong address, or the wrong cover, so the cadence pulls the current policy document each renewal.
Deeds and leases change on a move — the inventory that was right at the last house is wrong at this one, so the cadence rebuilds the what-you-cannot-replace list at every move.
Medical lists change with every prescription — the medication list is the record that rots fastest, so the cadence refreshes it at every GP or pharmacy change, and the kit carries the current one.
The inventory of what exists changes silently — a new account, a new policy, a new document, so the cadence re-runs the survivable-passwords inventory and re-points the three copies at the current list.
Tie the cadence to something you already do — the same clock-change or new-year trigger that rotates the kit water and charges the batteries, so the records and the kit stay current together and neither rots silently.

The review cadences logic is the survivable-passwords guides logic, transplanted to the paper: a record that is not reviewed rots as quietly as an unreviewed password list, and the rot is invisible until the day you reach for a copy that no longer proves anything. The passport expired, the policy renewed to the wrong cover, the deed from the last house, the medication list from before the prescription changed — each is a copy that exists and is useless, and the cadence is the thing that keeps the three copies current rather than merely present. The discipline is to tie the review to the same trigger as the kit, so the water, the batteries, and the records rotate together, and a household that maintains one maintains all three — because the record that was right three years ago is the record that fails on the day, and the day is precisely when you discover the rot.

A worked example: the fire, the firebox, and the printed password that was not there

Concretely, the three-copy rule, the record-versus-secret split, the what-you-cannot-replace inventory, the hybrid, and the review cadence meeting the house fire that proved the structure. A family loses a ground-floor room to a kitchen fire; the house is saved but the room is water-logged and smoke-filled, and the documents that were in a drawer in that room are gone.

The three copies diverge on the day. The on-site firebox — rated for both fire and water, in a bedroom cupboard outside the affected room — holds the encrypted USB and the printed records, and it survives. The offsite copy, a duplicate USB with a sister two towns away, survives because it was never in the house. The cloud copy survives too, but the family cannot reach it for two days: the power is out, the broadband is down, and the phone that would open the account is the one that was in the smoke-filled room. The cloud copy was the third, not the first, and the on-site printout is the thing the responder and the insurer actually use in the first hours — the insurance policy, the ID, the medical list, all reachable without a screen.

The record-versus-secret split is the thing that did not go wrong. The family had, a year earlier, been tempted to print "everything" into the firebox, including a sheet of passwords, and had stopped at the newspaper test: the passwords granted access, so they stayed in the break-glass, and only the records — the deeds, the policies, the IDs, the medical list, the inventory — went into the box. When the insurer's adjuster opened the firebox, the records proved the loss and the family's identity in an afternoon; and because the secrets were not there, the box being opened by a stranger handed over nothing. Had the password sheet been in the box, the same adjuster, the same relative, or a thief who took the box would have owned every account the records described — the skeleton key in the one place a responder is told to look.

The review cadence is the thing that made the copies usable. The passport copy was current because the cadence had re-scanned it at the last renewal; the insurance policy was the right cover because the cadence had pulled it at the last renewal; the medical list was current because the cadence had refreshed it at the last prescription change. A family that had scanned "once" three years earlier would have reached for a copy of an expired passport, a policy to the wrong address, and a medication list from before the prescription changed — records that existed and proved nothing. The lesson is the whole page: the structure that survived was the three copies failing differently, the guardrail that kept the box safe was the record-versus-secret split, and the thing that made the copies usable rather than merely present was the cadence. The fire took a room; the structure held; and the secrets stayed out of the box, so the box that proved the loss did not also cause one.

The Check

A Sensible Default

Hold the three-copy rule: on-site, offsite, cloud — and understand that each fails differently, so the redundancy is the point.
Demote the cloud: a cloud-only document is a ladder-four dependency that fails with the very outage you need it in — the third, never the only.
Draw the record-versus-secret line: records print, scan, encrypt; secrets never enter the kit — the newspaper test is the divider.
Route the secrets out: the break-glass in our survivable-passwords guide, not the firebox, because a printed secret is a skeleton key.
Build the what-you-cannot-replace inventory first — you cannot replace what you cannot prove existed, and the inventory is the raw material.
Use the hybrid: an encrypted USB for the comprehensive copy and a printout of the first-hours records, stored in the three places.
Rate the on-site box for both fire and water, and know the offsite access rule — a safe-deposit that seals on death is a dependency too.
Run the review cadence tied to the kit, because records expire and a copy that was right three years ago may be useless today.

The honest takeaway is that document continuity is a structure, not a scan, and the structure is three copies that fail differently, a record-versus-secret split that keeps the skeleton key out of the box, an inventory of what you cannot replace, a hybrid that makes the copies usable without a screen, and a cadence that keeps them current rather than merely present. The cloud copy is the third, not the first, because it fails with the very outage you need it in, and the secret is never printed, because a printed secret in a firebox is the one document that turns a proof of loss into a cause of one. For the stuff that bridges the same event, see our emergency-kit guide; for the coordination that survives it, see our family-communication-plan guide; for the secrets that never enter the kit and the break-glass they belong in, see our survivable-passwords guide; for the decommission inventory logic this page applies to the paper, see our decommission guide; for the ladder-four dependency framing this page transplants, see our privacy-economics guide; and for the record rules, replacement procedures, acceptance of scans, and box ratings specific to your place, see your national records or identity authority, your insurer, your bank, and a solicitor — the authorities this page keeps routing you to, because the structure of the three copies is durable and the specifics are not ours to assert.

A plain blank paper sheet lying beside a small closed metal strongbox with no combination visible, on a clean light surface — The blank paper sheet beside the closed strongbox with no combination visible are the record-versus-secret split made physical: the sheet is the record you print and store in the three copies, the strongbox is where the break-glass lives, and the two are deliberately apart so opening the sheet helps a stranger nothing. The strongbox stays unopened on purpose — the secrets never enter the kit, and the dividing line is the newspaper test.

Common Questions

Frequently Asked Questions

Which documents should I keep copies of?

The records you cannot replace: identification, insurance policies, property deeds or leases, birth and marriage certificates, medical histories and medication lists, financial statements, and wills or powers of attorney. The discipline is the what-you-cannot-replace inventory — if losing it means a wait or a fee or a claim you cannot prove, it belongs in the three-copy structure. The secrets are not on this list; they go in the break-glass, never in the kit.

Should I print my passwords and put them in the fireproof box?

No, and this is the irreversible failure the whole page stands against. A printed password, seed phrase, PIN, or private key in a fireproof box is a skeleton key: anyone who opens the box owns every account it unlocks, and the box is exactly where a responder, a relative, or a thief will look. Records print, scan, and encrypt; secrets do not. The secrets go in the break-glass our survivable-passwords guide builds, and the dividing line is the newspaper test — if a stranger reading it would gain access, it is a secret and it never enters the kit.

Is a cloud copy enough?

No, and the honest limit is the pages frame. A cloud-only document is a dependency that fails with the very outage you need it in: no power, no internet, no account access, and in the worst case a provider that has locked or lost the account on the day. The three-copy rule exists because the event that takes the house may take the cloud access too, and a single copy in any one place — a firebox, a drive, or an account — is a single point of failure.

How do I keep the copies usable and current?

By the hybrid and the cadence. Keep an encrypted USB of the records alongside printed copies, store the three copies in three places — on-site in a fireproof and waterproof box, offsite with a trusted person or in a safe deposit box, and in the cloud as a redundant third — and review on a cadence, because records expire and change: passports, policies, deeds, and medical lists all move, and a copy that was right three years ago may be useless today.

What is the difference between a record and a secret, exactly?

The newspaper test: if a stranger reading the line would gain access to anything, it is a secret; if they would gain only a fact about you, it is a record. A medical history is sensitive and still a record, because reading it opens no door; a password is not sensitive in the same way but it is a secret, because reading it opens every door. The dividing line is grantability, not sensitivity, and it is the line that keeps the firebox useful and harmless at once — a box a responder can open to prove your loss without handing over your accounts.

Is a safe-deposit box a good offsite copy?

It is robust and it is a dependency, and the honest answer is that it can be the wrong offsite copy for the first hours. A bank safe-deposit box can be sealed on death until an executor is appointed — the same access-gap the survivable-passwords guide warns of in another form — so the offsite copy with a trusted person outside the region is often more reachable in the first hours than the box at the bank. Use both if you can, but do not make the offsite copy the one that requires a court grant to open on the day you need the record.

Do I really need the printed copies if I have the encrypted USB?

Yes, and the reason is the same the cloud-only document fails for: a USB needs a reader and a screen, and the day you need the record is the day the power and the device may be gone. The encrypted USB is the comprehensive copy; the printout of the handful of first-hours records — identification, insurance, the medical list, the inventory — is the reachable one that needs neither. The hybrid holds both, because the record that is comprehensive but unreachable is the record that proves nothing on the day, and the printout is the thing a responder or an adjuster can use in an afternoon without a screen.

Ask our AI. Organising your documents? Tap the chat icon and tell us what you hold and where the copies are, and it can run the what-you-cannot-replace inventory with you, apply the newspaper test to whatever you have already printed, set the three-copy structure, and route the secrets to the break-glass — and it will always send the record rules, replacement procedures, and box ratings to your national authority, your insurer, your bank, and a solicitor, because the structure of the three copies is durable and the specifics are not ours to assert. It will never ask you to print a secret.