A few years ago the author lost access to a Facebook account because SMS-based two-factor codes stopped arriving on a Russian mobile number. Support offered identity verification via passport selfie, but the account was not important enough to pursue. The incident highlighted how everyday activities—work, finance, health, travel, and communication—now depend on digital services, so the failure of any single service disrupts real processes rather than just an app.
Digital resilience is defined as the ability to keep real-world processes running when their digital foundations break. It rests on two pillars: security, which limits unauthorized access and account takeover, and independence from any single provider, which guards against outages, policy changes, or sudden service closures. Corporate environments address these risks with dedicated teams and budgets; individuals rarely do.
The author models every process as a chain: real-world activity → digital service → access credentials → data. Failure can occur at any link, producing three main scenarios. When a service becomes unavailable, recovery requires a new service plus previously exported data in a portable format. When access is lost but the service still exists, the first step is to regain the original account; if that fails, a new account plus exported data is needed. When data are deleted or corrupted inside an otherwise working account, the same exported copy restores the prior state.
Because a complete audit of every digital process is impractical, the author recommends starting with the list of accounts already stored in a password manager. For each important account the security section is reviewed: strong unique password, modern second factor, and documented recovery options. Data-export capabilities are then checked so that information can be retrieved if the account is ever closed.
Accounts are treated as a dependency graph. Root nodes—those that can recover other accounts but are not themselves recovered through another account—are identified and isolated. Circular dependencies are removed, and recovery paths are split by jurisdiction to prevent a single regulatory event from affecting both trees. In the resulting structure, Yandex serves as the Russian root (with final recovery performed through support identity checks) while Google serves as the external root. Russian phone numbers and Yandex email were removed from Google’s recovery settings, and backup codes are stored offline. All high-value services were migrated from SMS second factors to TOTP codes generated by Ente Auth, chosen because its secrets can be exported and are not locked inside a single cloud provider.
Data are classified into three categories. Personal files under direct control are mirrored to independent locations. Data that exist only inside third-party services are exported in portable formats on a regular schedule. Secrets—password-manager exports, TOTP seeds, and recovery codes—are collected into a single encrypted archive whose master password is written on paper and kept separately. The archive and other backups are synchronized with rclone to two cloud storages in different jurisdictions plus an offline drive.
Recovery procedures are tested: exported files are imported into test environments, and the “forgot password” flow is walked through for critical accounts without actually resetting them. The author acknowledges that complete elimination of single points of failure is impossible; Google remains a large node whose loss would require rebuilding the external tree. The goal is therefore not zero-risk architecture but explicit knowledge of dependencies and a documented, testable path back to functional processes.
