Security and data protection
Looking after other people's information, and their money
Burial Desk holds the details of members, their families and what they have paid. Here is how the platform protects that information, and how responsibility for it is shared between your organisation and us.
How the platform protects your data
-
Access enforced in the database
Who may read or change each record is enforced by row-level security in the database itself, not only hidden in the app. An ordinary member reads their own records; in a burial society, members can also see the society's contributions unless an administrator turns that off for their role. Office-bearers and staff see what their role allows.
-
Money and claims change one way
A claim's status and a payment's outcome change only through the platform's own server-side steps, which check who is acting. A payment reference is recorded once, and a claim cannot be paid twice.
-
An audit trail
Changes to policies, premium payments, claims and policy documents are recorded with who made them, when, and the values before and after. Burial societies also keep an activity log of key events.
-
Private documents
Claim, policy and identity documents are kept in private storage and opened through links that expire after an hour.
-
Protected sign-in
Accounts people create themselves confirm their email address with a one-time code. The Burial Desk staff console also asks for a code from an authenticator app.
-
Statement links that expire
Statements emailed to members open with a long, single-person link that expires, and is replaced when a new statement is sent.
-
Payments verified before they count
An online payment is recorded only after PayFast's notification has been verified: its signature, the amount, and a server-to-server check with PayFast.
-
Encrypted connections
The website, the app and every request between them travel over encrypted HTTPS connections.
-
Reviewed policy companies
Every funeral company that registers is reviewed by our team before it appears in the online quote or can take self-service enrolments.
Shared responsibility
What Burial Desk does, and what stays with you
Burial Desk supports your compliance work. It does not make your organisation compliant, and it does not take on your obligations.
Burial Desk
- Provides, secures and maintains the platform
- Processes personal information as your operator under POPIA, on your instructions, only to provide the service
- Reviews every funeral company that registers before it is listed in the online quote or can take self-service enrolments
- Records payment outcomes reported by providers such as PayFast, but does not hold, transfer or safeguard member funds
- Is a software provider only: not an insurer, underwriter, financial services provider or intermediary, and does not give financial advice
Your organisation
- Is the responsible party under POPIA for the personal information of its members and policyholders
- Remains responsible for its own regulatory compliance, including FAIS and FSCA licensing, product approval, policy wording and conduct-of-business requirements
- Decides claims and payouts, and who in the organisation has access to what
- Is responsible for the legal accuracy of documents generated from its own content and settings
- Owns its merchant details and settlement arrangements with its payment provider
The binding wording is in our terms of service: section 3 (not an insurer), section 5 (POPIA) and section 8 (online payments).
POPIA
Members' rights over their information
People whose information is held on Burial Desk can ask to see it, correct it or have it deleted. Anyone can delete their own account from their profile in the app, or ask on our website and confirm by email; every request is recorded on our side, so none is lost in an inbox.
Questions
Security and compliance questions
Is Burial Desk an insurer or a financial services provider?
No. Burial Desk is a software provider only. It is not an insurer, underwriter, financial services provider or intermediary, and it does not give financial advice. Funeral policy companies that use Burial Desk remain responsible for their own licensing and regulatory compliance, including FAIS and FSCA requirements, product approval and policy wording.
Who is responsible for our members’ personal information?
Under POPIA your organisation is the responsible party for the personal information of its members and policyholders. Burial Desk acts as an operator: it processes that information on your instructions, only to provide the service. Section 5 of our terms sets this out.
Does Burial Desk hold our money?
No. Burial Desk records payments; it does not hold, transfer or safeguard member funds. Where online payments are switched on, they are processed by a payment provider such as PayFast under its own terms, and settle according to your arrangements with that provider.
Found something that looks like a security problem? Tell us at hello@burialdesk.co.za and we will look into it straight away.
Your organisation deserves better systems.
Take the next step towards simpler, smarter funeral organisation management.
Prefer email? Write to hello@burialdesk.co.za.