Security at BereaveGuide

We understand that you're sharing sensitive personal and legal information during a difficult time. Here's how we protect it.

Authentication & Account Security

  • Passwordless sign-in: Authentication via a trusted OpenID Connect provider — no passwords to steal or forget
  • Two-factor authentication (2FA): Optional TOTP authenticator app or email code for an additional layer of protection
  • Session management: Server-side sessions stored in PostgreSQL, automatically expiring after inactivity

Data Protection

  • Encryption in transit: All data is transmitted over HTTPS/TLS
  • Encryption at rest: Sensitive fields (including evidence notes) are encrypted using AES-256-GCM
  • UK GDPR compliant: We comply with UK GDPR and the Data Protection Act 2018

Access Controls

  • Case membership authorisation: Every API endpoint verifies you are a member of the case you're accessing
  • Rate limiting: API endpoints are rate-limited to prevent abuse
  • Log sanitisation: Sensitive data is excluded from server logs

Infrastructure

  • Hosted on SOC 2 Type II compliant cloud infrastructure
  • Database: Neon serverless PostgreSQL with automated backups
  • File storage: Object storage with access controls for uploaded documents and photos

Your Consent & Data Rights

BereaveGuide records your consent when you create an account. You can view your consent history and exercise your UK GDPR rights (access, rectification, erasure, portability) by contacting us at info@orbitalglobalgroup.com.

You can delete your account and all associated data at any time from within the app.

Reporting a Security Issue

If you discover a security vulnerability, please contact us immediately at info@orbitalglobalgroup.com. We take all reports seriously and will respond promptly.