How we protect your records

Each cemetery is kept separate

• Every customer’s records live in their own database schema. The application connects to it only after confirming which cemetery the request belongs to, whether it comes from a signed-in user or an API key.
• Scanned images and documents are kept in storage set aside for that customer.
• Background jobs, search and backups run separately for each customer.
• Account and billing information is held apart from records and never mixed with them.

Records can’t be quietly changed

• Every file gets a SHA-256 fingerprint in your browser before upload. The server checks it again on arrival and rejects any file that doesn’t match.
• Master images are stored write-once and copied to a second location. Every file is re-checked against its fingerprint each quarter, and a damaged copy is restored from the other.
• The database itself blocks deleting permanent records, overwriting verified entries and editing the audit log. These protections don’t depend on the application behaving correctly.
• Each register entry records where it came from: the ledger page, the signed document, the imported source row, or the API request that created it.
• A finalized case can’t be reopened. A mistaken record is voided with a reason, never deleted, and a voided record can’t be restored.
• On-screen signatures are stored write-once with the exact statement the signer agreed to, both fingerprinted, and can’t be edited or removed.

Access is limited and logged

• Roles match real jobs, from data entry to reviewer to crematory operator to board member. An inspector’s access expires on its own.
• Administrators and archivists must use two-step sign-in.
• Records marked restricted, such as disinterment photographs, are visible only to the roles you name, and each view is logged.
• Our staff can reach your data only when you approve a support request, for a set time, and the access is logged in your own audit trail.

Recovery

• The database can be restored to any moment in recent history, and a full export of each customer’s data is taken nightly into that customer’s own storage.
• Recovery targets: no more than 5 minutes of data loss, and service restored within 4 hours.

No lock-in

You can export everything at any time as a standard archival package (BagIt): images in TIFF and PDF, registers in CSV and JSON, and descriptive metadata in Dublin Core.

Report a vulnerability

Email security@cemeteryledger.com. We reply within two business days and will not take legal action against good-faith research that respects customer data.