How we protect your information

Encryption in transit

All traffic to willo.co.za uses HTTPS, and we tell browsers to only ever connect to us over HTTPS (HSTS). Connections from our application to our database are also encrypted (TLS).

Encryption at rest

• Database: our database provider, Neon, encrypts stored data with AES-256.
• Files: uploaded files (reference copies and attachments) are stored in Amazon S3 with server-side AES-256 encryption.

What we don't do yet: the information you type into Willo (such as ID numbers, account and policy numbers, and notes) is not separately encrypted by our application. It is protected by the storage-level encryption and access controls described here, but anyone with access to our database can read it. For this reason, please don't store passwords, PINs or full card numbers in Willo. Instead, record where your family can find them, for example in a password manager.

Access control

• Sign-in is handled by Clerk. Every request to your data is checked against the signed-in account, and you can only read or change your own records.
• People you add as beneficiaries can see your profile details, your will record and your reference copy, and nothing else. They get access as soon as you add them. Your family file is visible only to you.
• Files are never shared through permanent public links. When you or a beneficiary opens a file, Willo checks access and creates a link that expires after one hour.
• Card details are entered on PayFast's payment pages and never reach Willo.
• File uploads are secured behind the authentication layer and does not have any public access. Only you the signed in user and your beneficiary/executor that you have given permission to view data records will have access to these files.

Who at Willo can access your data

• Willo administrators can view and edit user profile details (including ID numbers) to provide support.
• The people who operate Willo have technical access to the database and file storage, which is needed to run and repair the service.

Backups

We keep backups of our database in encrypted cloud storage.

Monitoring

We use Sentry to detect errors. Some sessions are recorded to help us fix problems, with text and form inputs masked.

Where data is stored

Our database is in the United States and files are stored in Ireland. See the privacy policy for the full list of providers and regions.

Reporting a security issue

If you think you've found a security problem, please contact usand don't share it publicly until we've had a chance to fix it.