Your privacy

Not in their day-to-day work. Our everyday staff tools have no way to access your answers: they are encrypted with a key unique to you before they are saved, and those tools cannot open them. The only exception is the rare, strictly controlled break-glass procedure described under "Can DignitySA ever open my answers?".

In their day-to-day work, only the details needed to run the service and help you, never your answers or your documents. Those details are: your name and email address; which steps you have started or finished, and when; when you accepted the privacy statement; whether you have unlocked full access; how many documents you have stored and how much space they use, but not their names; the names, email addresses and phone numbers of the people you invite, and whether they have accepted; and your Will reminder dates.

Some of these you type in yourself, such as the people you invite and your reminder dates. We keep them separate from your answers because we use them to send your invitations and reminders.

If you ask us for an introduction to a provider, our team also receives the details listed in that request, including any message you add.

Only in rare, specific circumstances, through a break-glass procedure, and never through our everyday tools. DignitySA holds the encryption keys. That is what lets you reset a forgotten password without losing anything, and lets the people you invite read your answers.

We will only open your answers for one of four reasons: you asked us for help; a verified request after your death, or if you can no longer decide for yourself; a legal order; or a security incident.

One administrator must ask, giving the reason, and a different administrator must approve. Each confirms with a code from their own authenticator, so no one can do it alone. An approved request can be used once, read-only, for at most 60 minutes, and every step and every document opened is recorded.

We will always tell you when a request has been approved. For a request after your death, or if you can no longer decide for yourself, we also tell the people you invited who have accepted.

Outside the Navigator, the keys can be used only by two senior administrators, each with two-step sign-in, and every use automatically alerts both of them.

Our everyday staff tools have no way to access your documents, and their names are encrypted, so those tools cannot reveal what you have stored. The files are encrypted in storage in South Africa. A document can be opened only through the same break-glass procedure as your answers, for the same four reasons and with a second administrator's approval; each one opened is recorded, and we will always tell you. Apart from the Navigator itself and our automatic backups, the key that protects your documents can be used only by two senior administrators, each with two-step sign-in, and every use automatically alerts both of them.

No. To understand how the Navigator is used, and to report to our funders, we count things like how many members have finished a step. We never use what you write for research, reporting or marketing, and we never sell personal information.

Only the people you invite, and only once they have accepted your invitation. Nothing is shared before you invite someone.

Everything you have saved in every course, including What matters to you, and every document in your vault. They can read and download, but never change anything. They do not see your to-do list, any introductions you ask for, or answers in steps you have marked as not relevant to you. To see exactly what they see, choose Preview what they will see on My people.

Yes. My people shows when each person last viewed your information. You can remove anyone at any time, and their access ends straight away. Copies they have already downloaded or printed cannot be taken back, so invite only people you trust.

The people you have invited keep their access, so they have what they need. We are still settling how long we keep a member's information after their death, and how an executor can be given access, and we will update this page when we have.

Encryption scrambles information so that it can only be read with the right key. We use AES-256, the widely trusted gold standard for protecting sensitive information. Each of your answers is encrypted with a key unique to you before it is saved. Those keys are protected by a separate key service rather than kept in our database, so a copy of the database cannot be read on its own. Your documents and their names are encrypted too, and everything travels over encrypted connections.

Entirely in South Africa, in line with POPIA. Your answers, your documents and our backups are kept on Amazon Web Services in Cape Town, copied across at least three physically separate data centres, so they would survive the loss of an entire data centre.

Nothing is lost. Reset your password from the sign-in page, or ask for a sign-in link by email, and everything will be there.

Use a password you do not use anywhere else, and turn on two-step sign-in on your Member details page, so that a code from your phone is needed as well as your password. If you sign in with Google, protect your Google account in the same way.

We back up every night. Backups are encrypted before they leave our systems and are kept on Amazon Web Services in Cape Town, copied across at least three physically separate data centres. We keep daily copies for 35 days and monthly copies for 12 months. On top of that, a locked safety copy, which nobody, DignitySA included, can delete early, keeps each backup restorable for a further 35 days.

Yes, yourself, at any time. Your information (linked from My vault) deletes all of it: your answers, documents, to-do list, Will reminder and introduction requests, and the people you invited lose their access. Your membership and your unlock are kept, so you would not pay again to start over. You can also remove any single document from My vault.

Deleted information disappears from our backups as they expire, within about 13 months: monthly backups are kept for 12 months, and their locked safety copies for 35 days after that.

Yes. Your information (linked from My vault) downloads everything you have saved as one file. Your documents themselves are in My vault, where you can download each one.

Only what the request lists before you send it: your name, email address, WhatsApp number, suburb, city and province, the step you were on, and any message you add. It goes to the DignitySA team, who make the introduction. Nothing from your answers or your vault is shared.

They go only to your account email address. They say it is time to review your Will and when your next reminder is due, with a link back to the Navigator. They never contain your answers.

Email info@dignitysouthafrica.org. Our Information Officers are our Executive Directors. If you believe your information has been mishandled, you can also complain to the Information Regulator of South Africa (www.inforegulator.org.za).