Catalog.ID Recovery Sheet Custody Agreement

Framework agreement with a notary for the deposit of Account Recovery Sheets, the Netherlands

Last updated: 2026-10-19
Status: draft for review by the Notary, not executed

This Agreement is entered into by and between:

1. Roberto Bourgonjen, a private individual in the Netherlands, Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, operating catalog.id under operator code fndr ("Operator"); and
2. [name], notary (notaris) with place of business in Amsterdam, practising at Meijer Notarissen, Keizersgracht 695-699, 1017 DW Amsterdam, +31 (0)20 53 170 70, [email protected] ("Notary").

Operator and Notary are each a "Party".

Roberto Bourgonjen created the Catalog software and the catalog.id namespace (in that capacity the "Founder") and operates catalog.id himself, as a private individual. If the role of Operator passes to a company or other organisation, this Agreement transfers to it as described in section 11.2.

Recitals

A. catalog.id is a zero-knowledge identity and archive service. A member's private keys are generated on the member's own device and are stored by the Operator only as key bag entries encrypted under a credential the Operator never receives, the supersecret. The Operator cannot decrypt, recover or escrow a member's keys, and a member who loses the supersecret loses access to everything encrypted under it. This is a deliberate property of the system, described in the Catalog.ID Whitepaper §3.2.

B. To make loss, incapacity and death survivable without giving up that property, every account receives a Recovery Kit at registration: the supersecret is split with Shamir's Secret Sharing into printed Recovery Sheets, of which a fixed number together reconstruct it and fewer reveal nothing at all. The construction is specified in the Catalog.ID Recovery Kit Addendum (the "Addendum").

C. One of the schemas the registration offers is a kit of two sheets, both of which are needed. The member deposits Sheet A with a notary and places Sheet B with one or more persons of the member's own choosing. Neither the notary nor the holders of Sheet B can reconstruct anything alone. After the member's death or incapacity, the conditions under which the notary releases Sheet A are therefore the effective access control to the account. The Operator cannot perform that role: it does not know the member's legal identity, it cannot assess who a member's heir is, and it must not be in a position to direct the release of a sheet.

D. A notary is suited to the role. The Notary is bound by a statutory duty of confidentiality, identifies the persons for whom it acts, applies established standards of evidence to questions of succession and representation, and, when the Notary leaves office, the Notary's protocol passes to a successor notary by operation of law, so that a deposit can outlive the Notary, the Operator and catalog.id itself.

E. The Notary holds nothing of independent value. A single Recovery Sheet is useless on its own, in the information-theoretic sense, and under this Agreement the Notary never holds a quorum of sheets other than in sealed envelopes it may not open. The Notary's custody is the safekeeping of a sealed envelope under defined release conditions, nothing more.

F. This Agreement sets out the terms on which the Notary accepts such deposits from Account Holders under standard Deposit Terms, the fees the Notary charges for them, the procedure the Parties follow, and what each Party does and does not do. The Operator is not a party to any deposit.

1) Structure, definitions and precedence

1.1 Structure

This Agreement governs the relationship between the Parties. Each deposit is a separate engagement between the Notary and the Depositor, governed by the Deposit Terms referred to in Annex B, which the Operator publishes at catalog.id/deposit_terms/. The commercial and operational parameters are in Annex A. The intake checklist and the fields of the Deposit Record are in Annex C.

1.2 Definitions

• Account: a Catalog.ID identity: a personal account of a natural person, or an organization identity of a legal person.
• Account Holder: the natural person who holds a personal Account, or the legal person that holds an organization identity.
• Depositor: the Account Holder who makes a Deposit; for an organization identity, the organization, acting through a representative authorised to bind it.
• Recovery Kit, Recovery Sheet, sheet type, copy, quorum, supersecret, encrypted key bag bundle: as defined in the Addendum. A copy of a sheet type carries the same share as the original and counts as one sheet toward the quorum.
• Deposited Sheet: the copy of one sheet type that the Depositor deposits with the Notary under the Deposit Terms; in the two-sheet schema of recital C, Sheet A.
• Complementary Sheet: any sheet of a different sheet type of the same Recovery Kit, which must be brought together with the Deposited Sheet to reconstruct the supersecret; in the two-sheet schema, Sheet B. A Complementary Holder is a person holding a Complementary Sheet.
• Bundle Media: a durable storage medium carrying an encrypted key bag bundle of the Account, deposited together with the Deposited Sheet at the Depositor's option.
• Deposit: the engagement under which the Notary holds a Deposited Sheet, and any Bundle Media, for a Depositor under the Deposit Terms.
• Sealed Envelope: a tamper-evident envelope, closed in the Notary's presence and signed across its closure, carrying a seal number, the account id and the sheet type, and no other marking.
• Deposit Record: the Notary's record of a Deposit, with the fields listed in Annex C.
• Receipt: the Notary's written confirmation to the Depositor that a Deposit has been made, stating the fields of the Deposit Record that concern the Depositor.
• Release Event: the death of a natural-person Account Holder; the incapacity of a natural-person Account Holder, where the Depositor has elected release on incapacity; or, for an organization identity, the loss of every person authorised to represent the organization, its dissolution or its liquidation.
• Successor: the person entitled, under the Deposit Terms, to receive the Deposited Sheet after a Release Event.
• Verification Page: the anonymous page named on every Recovery Sheet, at which a sheet's QR code can be scanned to confirm that the sheet is intact, which Account it belongs to, and whether its recovery set is the Account's current one. It reconstructs nothing and transmits no share.
• Jurisdiction: the Netherlands.
• Membership Agreement: the Catalog.ID Membership Agreement between the Operator and each member; Organization Identity Agreement: the Catalog.ID Organization Identity Agreement.

1.3 Precedence

Between the Parties this Agreement controls. Between the Notary and a Depositor the Deposit Terms control, and nothing in this Agreement gives the Operator a right against the Notary in respect of an individual Deposit. The Addendum and the Whitepaper are descriptive; where they and this Agreement differ, this Agreement controls between the Parties.

2) The Notary's role

2.1 Acceptance of deposits

The Notary accepts a Deposit from any Account Holder who presents a Recovery Sheet naming the Notary as its custodian, under the Deposit Terms and against the fee in Annex A, subject to the Notary's professional rules and to the Notary's right to decline to act for a person under those rules. The Notary applies the Deposit Terms to every Deposit without variation, except where the Notary's professional rules or mandatory law require otherwise in an individual case.

2.2 Nature of the service

The Notary's service is the safekeeping of a Sealed Envelope and its release under the Deposit Terms. The Notary does not recover accounts, does not advise on Catalog.ID, does not monitor the Account, and does not hold, and cannot hold, any material from which the Account could be unlocked. The Notary gives no assurance that a recovery will succeed: that depends on a Complementary Sheet surfacing and on the state of the Account, neither of which is within the Notary's control.

2.3 Independence

The Notary acts for the Depositor, not for the Operator. The Operator gives the Notary no instructions concerning any Deposit, has no right to information about any Deposit, and can neither request nor prevent a release. The Notary is not the Operator's agent, processor or subcontractor.

2.4 Description of the service

Neither Party describes the Deposit as account recovery, key escrow or a guarantee of access. The Operator describes it in its software and on catalog.id as the safekeeping of one Recovery Sheet with a notary, in the words of the Deposit Terms. The Notary may name the service in its own communications in the same terms.

3) Intake

3.1 Identification

The Notary identifies the Depositor, and for an organization its representative and the representative's authority, in accordance with the Notary's professional rules. The identification binds a legal person to a pseudonymous account id in the Notary's records only; nothing of it is communicated to the Operator.

3.2 Verification of the sheet

Before sealing, the Notary scans the QR code of the Deposited Sheet at the Verification Page, on a device of the Notary's choosing, and confirms that the page reports the sheet as intact, that the fingerprint shown matches the fingerprint printed on the sheet, that the account id named matches the one the Depositor states, and that the sheet's recovery set is the Account's current one. If the Verification Page cannot be reached, the Notary records that the currency of the set could not be confirmed and the Deposit proceeds on the Depositor's statement. Scanning a single sheet reveals nothing about the supersecret and transmits no share.

3.3 Sealing

The Depositor places the Deposited Sheet, and any Bundle Media, in the Sealed Envelope in the Notary's presence. The Depositor and the Notary sign across the closure. The Notary writes the account id, the sheet type and the seal number on the envelope and nothing else.

3.4 Deposit Record and Receipt

The Notary records the Deposit in the Deposit Record and gives the Depositor a Receipt. The Notary makes and keeps no image, copy, scan or transcription of the Deposited Sheet; the account id, the sheet type and position, and the fingerprint are the only data about the sheet that the Notary retains.

3.5 The Depositor's elections

At intake the Depositor makes the elections provided for in the Deposit Terms: whether the Notary may release on incapacity, whether the Notary may take a Complementary Sheet into sealed deposit when its holder cannot keep it, and whether the Depositor has made, or intends to make, a testamentary designation of the person who is to receive the Deposited Sheet. The Notary records the elections in the Deposit Record. The Notary may, at its usual rates and as a separate engagement, draw up a will or codicil for the Depositor.

4) Custody

4.1 Safekeeping

The Notary keeps every Sealed Envelope in the secure storage in which it keeps its own deeds and items of value, protected against fire, water and unauthorised access, and apart from the Notary's working files.

4.2 Prohibitions

The Notary does not open a Sealed Envelope, does not copy, scan, photograph or transcribe its contents, does not bring a Deposited Sheet together with a Complementary Sheet other than in separate Sealed Envelopes, does not attempt or assist a reconstruction, and does not release a Sealed Envelope other than under the Deposit Terms. These prohibitions bind the Notary's staff and any successor notary.

4.3 Demands by third parties

If a court, authority or other third party demands a Sealed Envelope or information about a Deposit, the Notary invokes its duty of confidentiality to the extent the law allows, complies only with a demand it is legally bound to comply with, and informs the Depositor, or after a Release Event the Successor, where the law permits. The Operator is not informed and has nothing to contribute: it holds no material and knows no identity.

4.4 No periodic verification

Because the envelope is sealed, the Notary performs no periodic check of the Deposited Sheet. The Depositor is responsible, under the Deposit Terms, for replacing a Deposited Sheet that has been superseded by a new Recovery Kit. The Notary confirms to a Depositor who asks, in person or in writing with a verified signature, that the Sealed Envelope is in custody and that its seal is intact.

4.5 Replacement

When a Depositor replaces a Deposited Sheet, the Notary proceeds as at intake for the new sheet and returns the previous Sealed Envelope to the Depositor, or destroys it in the Depositor's presence, as the Depositor chooses. The Deposit Record notes the replacement.

4.6 Continuity of the protocol

When the Notary leaves office, the Deposits pass, with the Deposit Records, to the notary who takes over the Notary's protocol, and the Deposit Terms continue to bind that notary toward every Depositor. The Notary informs the Operator of the successor notary so that the Operator can update its software and the Schedule to the Deposit Terms. Where a Deposit cannot pass to a successor notary, the Notary offers each Depositor it can reach the return of the Sealed Envelope, and otherwise holds the Deposits until the Operator has arranged a transfer to another notary bound by equivalent terms.

5) Release

5.1 Grounds

The Notary releases a Sealed Envelope only to the Depositor, to a person the Depositor has authorised as the Deposit Terms allow, or after a Release Event to the Successor, in each case as set out in sections 6 to 9 of the Deposit Terms. The Notary determines whether a Release Event has occurred and who the Successor is on the evidence a notary in the Jurisdiction would require for the same question, under the law applicable to the succession or representation, and may require among other things a death certificate, a certificate of inheritance or of executorship, a European Certificate of Succession, a court order, a notarial power of attorney, or a trade register extract, with legalisation or apostille where the document is foreign. The Notary may itself issue a certificate it is competent to issue, at its usual rate, as a separate engagement.

5.2 Disputes among claimants

Where persons claiming to be the Successor disagree, or the Notary has reasonable doubt, the Notary suspends release until the claimants agree in writing or a court has decided. The Notary is not obliged to adjudicate.

5.3 The Complementary Sheet

The Notary holds no record of who holds a Complementary Sheet, and does not ask the Depositor. The Complementary Sheets printed for this schema name the Notary as the person to contact when the Account Holder has died or can no longer act. When a Complementary Holder comes forward, the Notary proceeds under section 9 of the Deposit Terms: before a Successor has been established the Notary records the holder's contact details and asks the holder to keep the sheet, or, where the Depositor has so elected and the holder cannot keep the sheet, takes it into sealed deposit, stored apart from the Deposited Sheet; after a Successor has been established the Notary refers the holder to the Successor, or releases a Complementary Sheet held in sealed deposit to the Successor together with the Deposited Sheet. The Notary never opens a Complementary Sheet's envelope and never holds an unsealed Complementary Sheet.

5.4 Handover

Release takes place in person at the Notary's office, against the Successor's signature on a handover record naming the seal numbers, the state of the seals and the date. The Notary informs the Successor in writing that whoever reconstructs the supersecret controls the Account, that the Account should receive a new Recovery Kit afterwards and may be closed only where the Account Holder's legacy policy allows it, and that what a Successor may do with the Account is governed by the Operator's agreements with the Account Holder, not by the Notary.

5.5 No role for the Operator

The Notary does not release to the Operator, does not ask the Operator to confirm the identity or entitlement of any person, and does not need the Operator's consent for a release. The Operator cannot confirm any person's identity and will not attempt to. The Notary may use the Verification Page at release to show the Successor, without opening the envelope, where a sheet can be checked once the Successor has opened it.

5.6 Good-faith release

A release made in good faith to a person who, on the documents presented and the Notary's professional standard, appeared entitled discharges the Notary toward the Depositor and the Operator.

6) The Operator's obligations

6.1 Printing the Notary's details

For an Account Holder who selects the Notary at registration or in the account settings, the Operator's software prints the Notary's name, address, telephone number and email address on the Deposited Sheet as its addressee, and on every Complementary Sheet of the same kit as the person to contact when the Account Holder has died or can no longer act. The Notary consents to this use of its name and contact details for the term of this Agreement and for the life of Deposits made during it. No logo, signature or other mark of the Notary is used.

6.2 Publication of the Deposit Terms

The Operator publishes the Deposit Terms, with the Schedule naming the Notary and the fees, at catalog.id/deposit_terms/, refers to them on the Deposited Sheet, and shows them to the Account Holder before the Notary is selected. The Operator does not change the Deposit Terms or the Schedule without the Notary's written agreement.

6.3 Verification Page

The Operator maintains the Verification Page as described in the Addendum: anonymous, usable without a Catalog.ID account, transmitting no share. The Operator does not guarantee its availability, and no obligation of the Notary depends on it.

6.4 Information and assistance

The Operator provides the Notary with the Addendum and a plain-language description of the Deposit for the Notary's staff, answers the Notary's questions about the system, and informs the Notary of changes to the Recovery Kit that affect intake or release before they take effect.

6.5 No payments between the Parties

The Operator pays the Notary nothing under this Agreement and receives nothing from the Notary. The Notary's fees are charged to Depositors and to the persons who collect, under Annex A. There is no referral fee, commission or revenue share in either direction.

6.6 The Account after release

What a Successor may do with a recovered Account, how long encrypted key bag entries are retained after a notified death, and when an Account is closed are governed by the Membership Agreement and the Organization Identity Agreement. The Operator keeps those agreements consistent with the Deposit Terms, so that a release under the Deposit Terms is not made pointless by the Operator's own rules. The Notary gives no assurance about, and bears no responsibility for, the state of the Account.

7) Fees

7.1 Fee schedule

The Notary charges the fees in Annex A: an intake fee, payable by the Depositor at intake and covering custody for the life of the Deposit; a release fee, payable by the person collecting at release; and, where Bundle Media are deposited, the fee for them. The fees are fixed amounts, include VAT where due, and are the only amounts the Notary charges for a Deposit. Certificates, wills, codicils or other notarial work a Depositor or Successor requests are separate engagements at the Notary's usual rates.

7.2 Changes

The Parties may change the fees in Annex A by written agreement. A change applies to Deposits made after the Operator has published it in the Schedule, with at least the notice period in Annex A. An intake fee already paid is never increased. The release fee applicable is the one published at the time of release.

7.3 No liability of the Operator for fees

The Operator is not liable for any fee or cost of a Deposit.

8) Data protection

8.1 The Notary as controller

The Notary is an independent controller for the personal data in the Deposit Records and in its handover records, and for the personal data printed on a Deposited Sheet or a Complementary Sheet it holds: the account id, the Account Holder's verified email address and telephone number, and the Account Holder's name as the Depositor states it. The Notary processes those data to perform the Deposit and to comply with its statutory duties, keeps them for as long as the Deposit lasts and for the retention period its professional rules require afterwards, and discloses them to no one except as sections 4.3 and 5 require.

8.2 Nothing flows to the Operator

The Notary communicates no personal data about any Deposit, Depositor, Complementary Holder or Successor to the Operator. The Operator does not learn which Account Holders have made a Deposit. The Notary may, once a year, tell the Operator the number of Deposits in custody, without any other detail.

8.3 The Operator's processing

The Operator processes the Account Holder's selection of the Notary on the Account Holder's own device, in order to print the sheets, and stores it only as part of the Account Holder's encrypted key bag, which the Operator cannot read. The Operator's processing of Account data is described in the Catalog Privacy Policy.

9) Liability

9.1 Division of responsibility

The Notary is responsible for the custody and release of Sealed Envelopes under the Deposit Terms and its professional law. The Operator is responsible for its software, its sheets and the Verification Page under its agreements with Account Holders. Neither Party is liable to the other for the other's area of responsibility. The Notary is not liable for the cryptography of the Recovery Kit, for the availability of the Verification Page, for the loss or non-appearance of a Complementary Sheet, for the state of an Account, or for the consequences of a recovery or of its failure. The Operator is not liable for the loss, damage, wrongful release or wrongful retention of a Sealed Envelope.

9.2 Limitation between the Parties

To the maximum extent permitted by law, neither Party is liable to the other for indirect or consequential damages, and each Party's total liability to the other under this Agreement in any twelve-month period does not exceed the amount in Annex A. The limitation does not apply to wilful misconduct, fraud or breach of section 8. The Notary's liability toward Depositors and Successors is governed by the Deposit Terms and the Notary's professional law, not by this section.

10) Term and termination

10.1 Term

This Agreement takes effect on the Effective Date in Annex A and continues for an indefinite period. Either Party may terminate it by written notice with the notice period in Annex A. Either Party may terminate it with immediate effect if the other Party materially breaches it and does not cure within thirty days of written notice, and the Operator may terminate it with immediate effect if the Notary leaves office without a successor notary taking over the Deposits.

10.2 Effects on new deposits

From the end of the notice period the Notary accepts no new Deposits, and the Operator ceases to print the Notary's details on newly printed sheets and removes the Notary from the Schedule. The Operator names a successor notary in the Schedule as soon as it has contracted one.

10.3 Effects on existing deposits

Termination of this Agreement does not end any Deposit. Every Deposit continues under the Deposit Terms until it ends in accordance with them. The Notary continues to handle the release of existing Deposits and the surfacing of Complementary Sheets as before. The Notary informs a Depositor who contacts it of the successor arrangements, and the Operator offers Depositors who wish to move their Deposit to the successor notary the reprinting of their sheets with that notary's details; the move itself is made by the Depositor, who collects the Sealed Envelope and makes a new Deposit.

10.4 The Operator ceasing to operate

If the Operator ceases to operate catalog.id and no successor Operator takes over, the Deposits continue under the Deposit Terms unaffected. The Verification Page may then be unavailable; the Notary's obligations do not depend on it. A Successor who holds a quorum of sheets and an encrypted key bag bundle can recover the Account without any Catalog.ID node, which is why the Deposit Terms allow Bundle Media to be deposited.

11) General

11.1 Language

This Agreement is drawn up in English. The Parties may execute a Dutch version; if they do, the Dutch text prevails. The Deposit Terms are published in English and in Dutch; between the Notary and a Depositor the version in the language of the Receipt prevails.

11.2 Transfer and assignment

The Operator may transfer this Agreement to a company or other organisation that takes over the role of Operator of catalog.id and assumes the Operator's obligations under it, by notice to the Notary. The Notary's rights and obligations pass to a successor notary as section 4.6 provides. Neither Party otherwise assigns this Agreement without the other's written consent.

11.3 Entire agreement and amendments

This Agreement, with its Annexes, is the entire agreement between the Parties on its subject matter. Amendments must be in writing and signed by both Parties.

11.4 Severability and waiver

If a provision is held invalid, it is modified to the minimum extent needed and the rest stands. Failure to enforce a provision is not a waiver of it.

11.5 Notices

Notices between the Parties are given in writing to the addresses above, by email with confirmation of receipt or by registered post.

11.6 Governing law and disputes

This Agreement is governed by the laws of the Netherlands. Disputes are first negotiated in good faith for thirty days from written notice and are then brought before the competent court in Amsterdam.

Annex A: parameters

Annex B: Deposit Terms

The Catalog.ID Recovery Sheet Deposit Terms, in the version published at catalog.id/deposit_terms/ on the Effective Date, are attached to this Agreement as a separate document and form part of it. Later versions apply to new Deposits as section 7.2 and the Deposit Terms provide.

Annex C: intake checklist and Deposit Record

Intake checklist

1. Identify the Depositor; for an organization, its representative and the representative's authority.
2. Check that the sheet names the Notary as its addressee and is a copy printed for a custodian, not the Depositor's original.
3. Scan the QR code at the Verification Page: the sheet is intact; the fingerprint shown matches the printed one; the account id matches; the recovery set is current. Record a currency check that could not be performed.
4. Take the Depositor's elections on the Deposit Instruction (Deposit Terms, section 4.4).
5. Seal: the Depositor places the sheet and any Bundle Media in the envelope; both sign across the closure; write the account id, the sheet type and the seal number on the envelope.
6. Complete the Deposit Record; collect the intake fee; issue the Receipt.
7. Remind the Depositor: keep the originals as securely as the supersecret; place the Complementary Sheets with more than one person; replace the Deposited Sheet when the kit is reissued; make a will or codicil if a specific person is to receive the sheet.

Deposit Record

Signatures

Roberto Bourgonjen, as Operator of catalog.id\
Signature: ___________ Date: ___________

[name], notary in Amsterdam\
Signature: ___________ Date: ___________