The Three-Location Rule
A document that exists in only one location is one fire, flood, or theft away from being gone. The redundancy framework is simple: every critical document exists in at least three separate physical or digital locations. No single disaster — including a house fire, a flood, a burglary, or a localized infrastructure failure — should be able to destroy all three.
The three locations are:
- Home safe — immediate access, physical originals
- Off-site physical — bank safe deposit box or trusted out-of-area contact
- Encrypted digital — USB drive and cloud backup
Location 1: Home Safe
What to Store Here
Physical originals or certified copies of all Tier 1-3 documents (see documents-to-waterproof.mdx for the full list). The home safe is your primary access point — the one you reach for when you need a document in the next 10 minutes.
Safe Selection Criteria
Fire rating:
- Minimum: UL Classified 1-Hour, Class 350 (maintains interior below 350°F for 60 minutes)
- Better: UL Classified 2-Hour, Class 350
- Class 350 = paper protection. If you're also storing USB drives or external hard drives, you need Class 125 (125°F interior for magnetic media) — most paper-rated safes get too hot for magnetic media
Water resistance:
- Look for ETL Verified water resistance rating (tested at submersion)
- Many fire safes are NOT water resistant — the fireproof insulation absorbs water if flooded
Size:
- Larger than you think you need. A standard document safe (0.5-1.0 cubic foot) fills faster than expected
- Letter-size internal dimensions minimum to avoid folding documents
Bolt-down:
- Bolt the safe to the floor or wall. An unbolted safe can be carried out by thieves.
Recommended approach: A 1.0-1.5 cubic foot safe with UL 1-hour Class 350 fire rating and ETL water resistance rating, bolted to the floor or wall. Budget $150-300 for a safe that actually performs to spec.
Organization Inside the Safe
Use waterproof document pouches or zip-lock bags labeled by category. Suggested categories:
- Identity (passports, birth certificates, SSN cards)
- Legal (will, POA, healthcare directive, marriage/divorce)
- Property (deeds, vehicle titles, mortgage summary)
- Financial (account numbers list, insurance policy numbers)
- Medical (immunization records, prescription list, insurance cards)
Location 2: Off-Site Physical
Bank Safe Deposit Box
Stores originals of the documents you least want to lose and least often need:
- Passport (if you don't travel frequently)
- Certified birth certificates
- Property deeds
- Military discharge papers (DD-214)
- Corporate/business formation documents
Access note: safe deposit boxes are only accessible during bank business hours. If you might need any of these documents outside those hours, keep a high-quality copy at home and the original in the box.
Trusted Out-of-Area Contact
An alternative to a safe deposit box: a sealed, labeled envelope of copies held by a family member or trusted contact who lives in a different geographic area. This person should:
- Be outside your likely disaster zone (not in the same hurricane or flood risk area)
- Understand what the envelope contains and what to do with it if you ask them to mail it
- Store it securely in their own home safe or safe deposit box
Give them a sealed envelope. You don't need to tell them the contents in detail — just "important emergency documents, please keep these safe and send them to me if I call and ask."
Location 3: Encrypted Digital
USB Drive Protocol
A USB drive with an encrypted container (VeraCrypt is free, open-source, and well-audited) provides digital access that works without internet.
Setup:
- Download and install VeraCrypt on your computer
- Create an encrypted volume on the USB drive (AES-256 encryption, strong passphrase)
- Scan or photograph all critical documents at high resolution
- Store scans inside the encrypted volume
- Also include: a typed contact list, account number list, and medical summary document
- Eject, label the USB, and store it in your go bag or home safe
The passphrase: Long enough to be secure, memorable enough that you'll know it under stress. A four-to-five word passphrase (not common phrase) is more secure than a complex 12-character password and more memorable. Write it down and store it separately from the USB drive — not in the same bag.
Update frequency: Refresh the scans annually, or any time a major document changes (new passport, updated will, new insurance policy).
Cloud Backup
The encrypted VeraCrypt container file can be uploaded to any cloud storage service. Because it's encrypted before upload, the cloud provider cannot read the contents.
Options:
- Google Drive, iCloud, Dropbox — any will work if the container is encrypted before upload
- Proton Drive — end-to-end encrypted natively (additional layer)
Upload the encrypted container file. Your cloud account password must be separate from the container passphrase.
Maintenance Schedule
| Frequency | Task | |-----------|------| | Annually | Review document list for additions/changes | | Annually | Rescan updated documents (new passport, updated will, etc.) | | Annually | Verify USB drive reads correctly | | Annually | Test decryption of the encrypted container | | After major life events | Update (marriage, divorce, new property, new will) | | After moving | Update address references; notify safe deposit box bank |
Quick-Start: Minimum Viable Setup in 2 Hours
If you have no document storage system at all:
- Gather your documents — passport, birth certificates, Social Security cards, insurance cards, vehicle titles
- Photograph each one with your phone (front and back)
- Create a secure note in a password manager (1Password, Bitwarden) with the photos and key account numbers
- Buy a waterproof document pouch ($10-15 at any office supply store) and put physical copies in your go bag
- Put the originals back in the best secure location you have (a drawer that locks is better than nothing)
This is the floor. Build up from here. The goal is making the full three-location system, but something is dramatically better than nothing.
Sources
Frequently Asked Questions
Are fireproof safes actually fireproof?
No safe is truly fireproof — they are fire-resistant for a rated duration. A UL Classified 1-hour safe maintains interior temperature below 350°F for 1 hour at 1,700°F external temperature. Paper chars at 451°F; magnetic media fails at lower temperatures. Buy by UL rating, not marketing claims. Verify the rating is for paper (class 350) not just media (class 125/150).
Is it safe to store documents in a cloud service?
With encryption, yes. Without encryption, no. A Google Drive or iCloud folder full of unencrypted passport scans and SSNs is a significant identity theft risk. Encrypt with VeraCrypt before uploading, or use a service designed for sensitive documents. The encryption key must be stored separately from the encrypted files.
Should I use a safe deposit box at a bank?
For originals of highest-value documents (passport, birth certificate, property deeds), yes. Safe deposit boxes are not FDIC insured, and banks can (rarely) deny access during banking crises. The box is for fire/theft protection of documents — it is not a financial account. A bank crisis does not affect your ability to retrieve physical documents, but normal banking hours do. Don't store anything you might need during off-hours.