Privacy
We hold records about people who have died and the families burying them. That is about as sensitive as data gets. Here is exactly what we keep, why we keep it, and what we will never do with it.
The short version
- We do not sell family data. Not to insurers, not to monument dealers, not to lead brokers, not to anyone. There is no exception further down this page.
- We do not use decedent or family records to train AI models — ours or anyone else’s.
- The funeral home owns its records. If you leave, you take them with you in a machine-readable export, and we delete ours.
- The most sensitive fields are encrypted individually, not just “encrypted at rest” as a checkbox.
What we actually store
Three kinds of record, and they are treated differently.
Decedent records
Legal name, preferred name, dates and places of birth and death, sex, race and ethnicity as recorded, education, occupation and industry, marital status, surviving spouse, manner of death and veteran status. These are the fields a death certificate demands; we hold them because filing is the job.
Four fields are held as ciphertext under a per-record key, so they are unreadable even to someone holding a database dump: social security number, cause of death, contributory conditions, and veteran service data.
Family records
Names, relationship to the decedent, contact details, and what the family told the arranger about the person who died. Consents are recorded with a timestamp so it is always clear what was agreed and when.
Operational records
Chain-of-custody scans, service and merchandise selections, price lists, insurance assignments, obituary drafts, aftercare correspondence, and an audit log. The audit log is append-only: it records who looked at what and when, and it exists so that a family can be told the truth if they ever ask.
Who can see it
Records belong to one funeral home and are partitioned so that no other funeral home on Vestamere can reach them. Within a home, access follows the role the director assigns. Every read of a protected-health-information route is logged.
The family portal shows a family only their own case, and only what the funeral home has chosen to publish to it.
Vestamere staff do not browse customer records. Support access requires the funeral home to ask, is scoped to the case in question, and is written to the same audit log you can read.
Who else touches the data
Every subprocessor, what it does, and why it is unavoidable:
- Neon — the Postgres database itself.
- Vercel — application hosting.
- Clerk — staff sign-in. Holds email addresses, not case data.
- AWS KMS and S3 — key custody and document storage.
- Postmark — aftercare and notification email.
- Inngest — background jobs, including the body-tracking service-level alerts.
- Sentry — error monitoring, with request bodies scrubbed.
- A large-language-model provider — used for drafting obituaries and summarising documents. Prompts are sent for the duration of the request and are not retained for training. See the next section.
A business associate agreement is required from each subprocessor that can touch protected health information before real records go into production.
On the AI
Where a model is used — obituary drafting, document extraction, summarising an intake conversation — it drafts and a human approves. Nothing a model produces is filed, sent to a family, or submitted to a registrar without a person reading it first.
Model output is never treated as a source of fact about a decedent. It restates what the record already contains.
How long we keep it
Case records are kept for as long as the funeral home needs them, which is generally set by state retention rules rather than by us. When a funeral home leaves, it gets a complete export and we delete the originals, retaining only what the law requires us to keep.
The audit log outlives the case it describes, because a log you can delete is not a log.
What families can ask for
A family can ask the funeral home what Vestamere holds about their case, ask for corrections, and ask for a copy. The funeral home is the right first stop because the records are theirs; we support them in answering rather than answering over their head.
Breach
If records are exposed, we tell the affected funeral homes what happened, what was reached, and what we are doing about it — with facts rather than reassurance, and without waiting for the legal deadline to run down.