Security

Case records hold decedent details, next-of-kin contacts, dates of birth and death, and payment history. They are encrypted on the wire and on disk, and the fields carrying the most sensitive values are encrypted a second time inside the application, so a copy of the database on its own does not read them.

Access follows the role, and it is scoped by location as well as by permission. A director at one rooftop does not see another rooftop's cases unless someone with admin rights grants it.

What staff see

• Only the cases and locations assigned to their role
• The details they need for arrangements and tasks
• Documents and e-signatures tied to their own cases
• Payment status and balances on the cases they work

What admins control

• Per-user and per-location permissions
• Which roles can view, edit, or manage cases
• Multi-location access and reporting across every location
• Adding and removing staff, and adjusting their access

Authentication

Sign-in is handled by a dedicated identity provider, so we never store or see your password. Sessions are refreshed on every request and end on sign-out, and the organization boundary is re-checked on every page load rather than trusted from the address bar: a request that cannot establish which firm it belongs to is refused rather than answered.

The question after an incident is rarely what happened. It is who did it, and when. The records that answer that are written in the same transaction as the change itself, so an action cannot succeed without also being recorded.

Card and ACH payments are processed by our payment provider using PCI-compliant handling. Card numbers and bank details are held by the provider and are never stored on our systems or on yours, so neither your firm nor FuneralHQ is holding the data that makes a card breach possible. What we keep against a case is the amount, the status, and the reference needed to reconcile it.

Backups run automatically and are encrypted at rest like the live data. They exist for the ordinary failures as well as the dramatic ones: a deletion that should not have happened is far more common than a lost disk.

Backups are not a substitute for your own export. Keeping a periodic export of your own records is the practice we recommend to every firm, and Data Ownership covers how.

These are the third parties that can touch your data in the course of running the Service. It is the same set named in our Privacy Policy, so the two documents cannot drift apart without one of them being visibly wrong.

Case, contact, document, and payment records belong to your firm. We hold and protect them on your behalf, and we do not sell them, mine them, or use them to train anything.

• Export your records at any time, in a machine-readable format
• On termination, at least 30 days to export before anything is deleted
• Retention periods for each kind of record are set out in the Privacy Policy

Where is my data?

In the United States, encrypted at rest, and backed up automatically. The records belong to your firm.

Can another funeral home see my cases?

No. Every query is scoped to one organization by a mechanism that returns nothing rather than guessing when it cannot establish which tenant a record belongs to.

What happens if I leave?

You export your records, and you have at least 30 days to do it before anything is deleted. There is no fee to take your own data with you.

Do you hold card numbers?

No. Card and bank details stay with our PCI-compliant payment provider. We hold the amount, the status, and the reconciliation reference.