Security & trust · Reviewed 2026-06-28
How your funeral home's data stays your funeral home's data.
Funeral homes hold sensitive compliance information for vulnerable consumers. Multi-tenant isolation, citation-grounded AI, and conservative phrasing were foundational requirements — not afterthoughts bolted on for a security review.
Funeral Sentry provides compliance workflow software and operational intelligence. It is not a law firm and does not provide legal advice. Determinations of legal compliance must be made by qualified counsel or a credentialed compliance professional.
01What we built first
Four control surfaces. Reviewed quarterly.
Each category is implemented in code today, audited by tests in CI, and reviewed quarterly. The next review date appears in the corner of each section.
Where your data lives.
Reviewed 2026-06-28Tenant isolation by design
Every organization-owned record carries an organizationId. Service-layer guards reject queries that try to cross tenant boundaries; cross-tenant reads return 404 with no information leak about whether the record exists.
Isolated production infrastructure
Production runs on isolated infrastructure with restricted service access — internal services are never exposed to the public internet, and all traffic terminates through a hardened proxy layer.
Daily backups + restore drill
Data stores are backed up daily with a rolling retention window. A recurring restore drill proves the backups actually work by loading them into a disposable environment — a backup that has never been restored is a hope, not a control.
Operator-controlled data export
Full export at any time — JSON, CSV, or sealed PDF with hashed integrity. Cancellation does not gate your records. Compliance data follows the funeral home, not the vendor.
In transit, at rest, and in URLs.
Reviewed 2026-06-28TLS in transit
All public HTTP traffic is HTTPS-only with HSTS preload enabled and a strict Content-Security-Policy header. Auth.js secrets and Stripe keys are never returned in API responses.
Time-limited evidence URLs
Document downloads go through 10-minute presigned URLs. Direct bucket access is denied by default; storage keys begin with the organizationId so a misdirected listing can never expose another tenant’s files.
Encryption at rest
Database and object-store volumes are encrypted at the infrastructure layer. Sensitive metadata (password hashes, OAuth tokens, payment keys) is also stripped from audit logs by an explicit denylist.
Secrets never leave the server
Third-party API credentials are held in access-restricted server configuration. They are never echoed to logs, never sent to the client, and never written into the database.
Who can do what, and what we wrote down.
Reviewed 2026-06-28Nine roles, server-side enforced
OWNER, ADMIN, MANAGER, DIRECTOR, STAFF, AUDITOR, CONSULTANT, LEGAL, PLATFORM_ADMIN. Thirty-plus permissions. Server-side gates only — the UI never decides authorization, it only hides the controls.
Append-only audit log
Every business event writes an audit row with actor, action, entity, organization, location, request id, IP, and user-agent. Logs use polymorphic refs so model splits don’t orphan history. The platform itself never deletes or updates an audit row.
Platform-admin support is logged
When a Funeral Sentry platform admin accesses your tenant for support, an admin.support audit row records the session. You can ask us to surface those entries to your audit packets on request.
Read-only-after-lapse
If a subscription enters PAST_DUE for more than seven days, mutating routes are gated with a 403. Compliance evidence remains readable forever — but no new writes happen until billing is reconciled.
The trade-offs we picked on purpose.
Reviewed 2026-06-28No legal advice, by design
Funeral Sentry will never tell you "you are compliant" or "guaranteed FTC safe". The product uses phrasing like "potential issue" and "review recommended" so determinations are always made by qualified counsel.
AI output is citation-grounded
Every AI finding must cite a real source from your input GPL — a disclosure key, a price item name, or a specific FTC section. Citations that don’t match the source are preserved but downgraded to ESCALATE so a human reviews them.
SOC 2 readiness on the roadmap
We’re building toward SOC 2 readiness with discrete controls — encryption, access reviews, vendor risk, incident response. We are not SOC 2 attested today. We’ll publish progress as we get there.
Conservative defaults everywhere
Published GPL versions are immutable. HIGH-severity risk flags require manual close. AI findings wait for human approval. Cross-tenant reads are impossible. Each default biases toward "evidence" over "convenience".
02Honest about scope
What we are not (yet).
We list these because pretending they’re true would be a worse trust signal than admitting they’re not. Each is on a published roadmap.
SOC 2 Type II attested
We are building toward SOC 2 readiness with the controls listed above. We are not attested today. Independent attestation is on the roadmap.
HIPAA business associate
Funeral Sentry is not a HIPAA covered entity or business associate. Funeral home records typically fall outside HIPAA; if your use case requires BAA, we are not yet equipped.
Single-sign-on for every tier
SSO via SAML / SCIM is included on the Enterprise tier today. We will broaden SSO across more tiers as the customer base grows.
Independent penetration test
An external pen-test is scheduled before public launch. Until that report exists, we will not claim "third-party verified." We will publish the result either way.
Multi-region failover
Production runs from a single region today, with local and offsite backups. Multi-region active-active is not on the current product slope.
Bug bounty program
We accept responsible-disclosure reports at security@funeralsentry.com. A formal bounty program will follow the pen-test. Reports are acknowledged within one business day.
Have a question we didn't answer?
We'll answer concrete security questions.
Architecture diagrams, control summaries, trade-off discussions — anything you need to evaluate the platform. We don't hide behind security-theater language. If we can't answer something publicly, we'll say so.