Your privacy

Not in their day-to-day work. Our everyday staff tools have no way to access your answers: they are encrypted with a key unique to you before they are saved, and those tools cannot open them. The only exception is the rare, strictly controlled break-glass procedure described under "Can DignitySA ever open my answers?".

In their day-to-day work, only the details needed to run the service and help you, never your answers or your documents. Those details are: your name and email address; which steps you have started or finished, and when; when you accepted the privacy statement; whether you have unlocked full access, and the dates of your 30 free days and of any lock; how many documents you have stored and how much space they use, but not their names; the names, email addresses and phone numbers of your trusted people, and whether those you invited to log in have accepted; when you emailed a document, to whom, and whether it was delivered, but not which document; and your Will reminder dates.

Some of these you type in yourself, such as your trusted people and your reminder dates. We keep them separate from your answers because we use them to send your documents, invitations and reminders.

If you ask us for an introduction to a provider, our team also receives the details listed in that request, including any message you add.

Only in rare, specific circumstances, through a break-glass procedure, and never through our everyday tools. DignitySA holds the encryption keys. That is what lets you reset a forgotten password without losing anything, and lets the people you invite read your answers.

We will only open your answers for one of four reasons: you asked us for help; a verified request after your death, or if you can no longer decide for yourself; a legal order; or a security incident.

One administrator must ask, giving the reason, and a different administrator must approve. Each confirms with a code from their own authenticator, so no one can do it alone. An approved request can be used once, read-only, for at most 60 minutes, and every step and every document opened is recorded.

We will always tell you when a request has been approved. For a request after your death, or if you can no longer decide for yourself, we also tell the people you invited who have accepted.

Outside the Navigator, the keys can be used only by two senior administrators, each with two-step sign-in, and every use automatically alerts both of them.

Our everyday staff tools have no way to access your documents, and their names are encrypted, so those tools cannot reveal what you have stored. The files are encrypted in storage in South Africa. A document can be opened only through the same break-glass procedure as your answers, for the same four reasons and with a second administrator's approval; each one opened is recorded, and we will always tell you. Apart from the Navigator itself and our automatic backups, the key that protects your documents can be used only by two senior administrators, each with two-step sign-in, and every use automatically alerts both of them.

No. To understand how the Navigator is used, and to report to our funders, we count things like how many members have finished a step or sent a document. We never use what you write for research, reporting or marketing, and we never sell personal information.

Only the people you choose. Your trusted people receive only the documents you decide to email them. With full access, you can also invite them to log in, and once they accept, they can read your answers in the areas you chose for them: Healthcare, Estate or Memory. Nothing is shared until you send a document or invite someone.

Without a login, only the documents you email them. Once they accept an invitation to log in, which you can send with full access, they see the steps in the areas you chose for them, with what you saved there and the documents you uploaded: Healthcare (your health care wishes and the people who would speak for you), Estate (your Will, money and affairs) or Memory (your wishes for your body and your funeral, and how you would like to be remembered). A step can be in more than one area: What matters to you, for example, is in Healthcare and Memory. Someone in all three areas can read everything you have saved, in every course, and open every document in your vault. They can read and download, but never change anything. They do not see your to-do list, any introductions you ask for, or answers in steps you have marked as not relevant to you. To see exactly what each person sees, choose Preview under their name in My people.

For people with a login, yes. My people shows when each person last viewed your information. You can remove anyone at any time, and their access ends straight away. Documents you have emailed, and copies anyone has downloaded or printed, cannot be taken back, so share only with people you trust.

The documents you have emailed stay with the people you sent them to, and the people you invited to log in keep their access, so they have what they need. We are still settling how long we keep a member's information after their death, and how an executor or the people you choose can be given access, and we will update this page when we have.

You choose the document and who receives it. The Navigator suggests who should get each one: your Section 7 Mandate and Living Will go to the people you chose for Healthcare; the documents about your Will, policies and investments to those you chose for Estate; and your wishes for your body to those you chose for Memory. Before anything is sent, we show you what will go to whom and ask for your consent, every time, because a document can hold special personal information, such as your wishes about medical treatment.

The email comes from the Dignity Navigator and names you, and replies go to your email address. It is sent through Amazon Web Services' email service in Cape Town, which keeps no copy once the email has been delivered.

To the inbox of each person you chose, where their email provider, such as Gmail or Outlook, keeps it, possibly outside South Africa. From then on it is outside our storage and our protection, and anyone who can open that inbox can read it.

No. Once delivered, it is the recipient's copy, and we cannot delete it or call it back. You can stop sending to someone by removing them from My people, and if you change a document, you can send them the new version and ask them to delete the old one.

Each email also tells the person who we are, why they have received it, and how to ask us to stop. If they ask, we send them nothing more, and My people shows you that they asked.

A record of each send: which document, to whom, when, and whether it was delivered. We keep no copy of the email or of the document made for it.

Encryption scrambles information so that it can only be read with the right key. We use AES-256, the widely trusted gold standard for protecting sensitive information. Each of your answers is encrypted with a key unique to you before it is saved. Those keys are protected by a separate key service rather than kept in our database, so a copy of the database cannot be read on its own. Your documents and their names are encrypted too, and everything travels over encrypted connections.

Your answers, your documents and our backups are stored entirely in South Africa, in line with POPIA. They are kept on Amazon Web Services in Cape Town, copied across at least three physically separate data centres, so they would survive the loss of an entire data centre.

Emails are different. A document you choose to email is sent through Amazon Web Services' email service in Cape Town, which keeps no copy once it has been delivered, and then sits in the recipient's inbox, wherever their email provider keeps it. Our other emails, such as reminders, invitations and receipts, go through an email service in the United States, which keeps a copy of each for 30 days. They never contain your answers or documents.

Nothing is lost. Reset your password from the sign-in page, or ask for a sign-in link by email, and everything will be there.

Use a password you do not use anywhere else, and turn on two-step sign-in on your Member details page, so that a code from your phone is needed as well as your password. If you sign in with Google, protect your Google account in the same way.

We back up every night. Backups are encrypted before they leave our systems and are kept on Amazon Web Services in Cape Town, copied across at least three physically separate data centres. We keep daily copies for 35 days and monthly copies for 12 months. On top of that, a locked safety copy, which nobody, DignitySA included, can delete early, keeps each backup restorable for a further 35 days.

Yes, yourself, at any time. Your information (linked from My vault) deletes all of it: your answers, documents, to-do list, trusted people, the record of documents you sent, Will reminder and introduction requests, and the people you invited to log in lose their access. Documents you have emailed are not deleted: they are with the people you sent them to. Your account, your DignitySA membership if you have one, and any full access are kept, so you would not pay again to start over. You can also remove any single document from My vault.

If you start with 30 days free and haven't got full access, Your information closes your Navigator instead (see "What does closing my Navigator delete?").

Deleted information disappears from our backups as they expire, within about 13 months: monthly backups are kept for 12 months, and their locked safety copies for 35 days after that.

If you start with 30 days free and haven't got full access by the end of the 30 days, or of the free extra month if you take it, your Navigator is locked. We keep everything in it safely, and you can still sign in to read and download it, but you can't change anything or send documents from it. You can get full access, or delete everything, at any time. We email you reminders during the following year, and if your Navigator is still locked a year after it was locked, we delete everything in it and tell you that we have. If you use your login for nothing else, it is deleted too.

With full access, your Navigator is never locked: it is kept for as long as you keep your account.

If you start with 30 days free and haven't got full access, you can close your Navigator at any time, from Your information or when your free days end. Closing deletes everything in it: your answers, documents, to-do list, trusted people, Will reminder, introduction requests and the record of documents you sent. We offer you a download of everything first. Documents you have emailed stay with the people you sent them to.

If you use your login for nothing else, it is deleted too. If you are a DignitySA member, or someone shares their Navigator with you, your login stays, and so do the dates of your 30 free days, marked closed. You can start again, with 30 days free, whenever you like. Records of payments are kept for as long as the law requires for our accounts, and deleted information disappears from our backups as they expire, within about 13 months.

Yes. Your information (linked from My vault) downloads everything in one zip file: the documents the Navigator makes from your answers, the files you uploaded, and one file with your answers and records. You can also download each file you uploaded from My vault.

Only what the request lists before you send it: your name, email address, WhatsApp number, suburb, city and province, the step you were on, and any message you add. It goes to the DignitySA team, who make the introduction. Nothing from your answers or your vault is shared.

They go only to your account email address. They say it is time to review your Will and when your next reminder is due, with a link back to the Navigator. They never contain your answers.

Email [email protected]. Our Information Officers are our Executive Directors. If you believe your information has been mishandled, you can also complain to the Information Regulator of South Africa (www.inforegulator.org.za).