You're trusting us with Social Security numbers, death certificates, financial account details, and a full picture of your family's finances. That's about as sensitive as personal data gets, and we treat it that way.
Sunset is SOC 2 Type I and Type II certified. You can review our certifications, security controls, and compliance posture yourself at our Security Center.
What SOC 2 Certification Means
SOC 2 is an auditing standard developed by the American Institute of CPAs for service providers that handle customer data. Sunset holds both certifications:
Type I verifies that our security controls are properly designed and in place at a point in time.
Type II goes further and verifies that those controls actually operated effectively over an extended period. An independent auditing firm examined our real practices, not just our written policies.
The audit covers security, availability, processing integrity, confidentiality, and privacy. It also requires annual re-auditing, so this isn't something we passed once and stopped thinking about.
Plenty of companies say they take security seriously. SOC 2 is independent verification that we actually do, and our Security Center lets you check rather than take our word for it.
Encryption
In transit. TLS 1.3 encrypts everything moving between your device and our servers. When you enter a Social Security number or upload a death certificate, it's encrypted before it leaves your device.
At rest. AES-256 encryption on all stored documents, personal information, and financial data. Encryption keys are managed separately from the data itself, so access to a database alone wouldn't make anything readable.
In backups. Backups are encrypted too, stored in geographically separate locations, with separately managed keys.
Passwordless Login
Sunset doesn't use passwords. You enter your phone number, we text you a one-time code, and you enter it. Each code expires within about 10 minutes and works only once.
This is more secure than a password, not less. There's no password to steal in a breach, guess, or crack, and no risk from reusing a password you also use elsewhere. Someone would need both your phone number and physical access to your phone.
If you can't access your phone
Lost phone, changed number, traveling, or a number entered wrong at signup. Contact us from any email address with your name, your loved one's name, the number you think is registered, and a new number if you have one. We'll verify your identity another way, using details from your account and the documents you've uploaded, then update your number.
Never share a code
Not with family, and not with anyone claiming to be from Sunset. We will never call, text, or email asking for your authentication code. If you receive a code you didn't request, don't use it, let it expire, and tell us. Someone may be attempting to access your account.
Who Can See Your Data
Very few people, and every access is logged.
Only employees who need access to help you have it
Access is role-based. Customer support can see account status but not full Social Security numbers or account numbers.
Engineering does not access customer data in production
Employees with data access undergo background checks and sign confidentiality agreements
Access logs record who viewed what, when, from where, and why, and are reviewed for unusual patterns
Sessions time out after inactivity, and repeated failed login attempts trigger additional checks.
Document Handling
Upload documents through your Sunset dashboard rather than email. Files are encrypted on upload, scanned for malware, and stored redundantly across multiple data centers.
When we send documents to financial institutions on your behalf, they go by secure methods only, never plain unencrypted email, and delivery is tracked.
Documents are kept only as long as needed for your estate settlement. Deleted documents are cryptographically erased rather than just hidden from view, and backup copies are purged on the normal rotation.
Infrastructure and Testing
Sunset runs on enterprise cloud infrastructure with firewalls, intrusion detection, DDoS protection, network segmentation, and 24/7 monitoring with automated alerting.
We test rather than assume. Independent security firms run annual penetration tests, automated vulnerability scanning runs multiple times a week, and anything found is prioritized, fixed, and re-tested.
Security researchers can report vulnerabilities to [email protected]. We take responsible disclosure seriously.
Privacy
What we collect
Your loved one's identifying details, your contact information and relationship, the documents you upload, the results of the search, and your phone number for authentication.
What we don't do
We don't access your personal financial accounts
We don't track your browsing outside Sunset
We don't sell your data, and we don't share it with data brokers or marketers
We don't use your information for anything unrelated to settling the estate
We don't store passwords, because we don't use them
Who we share with
Financial institutions get only what they need to process your requests. Our banking partner receives what's needed to open the estate account. Our SMS provider receives your phone number to deliver codes. Service providers that help us operate work under confidentiality agreements. Legal authorities receive information only when legally compelled by a valid court order or subpoena, never voluntarily.
Your rights
You can access the data we hold, correct it, request deletion after settlement is complete, update your phone number, opt out of non-essential communications, and receive your data in a portable format. Email [email protected] to exercise any of these.
How long we keep things
During an active case, as long as settlement requires. Afterward, documents stay available for your reference and can be deleted on request. Some financial records are retained longer for regulatory compliance. If you close your account, data is deleted within 30 days apart from records we're legally required to keep.
Compliance
Sunset complies with the Gramm-Leach-Bliley Act, state privacy laws including the California Consumer Privacy Act, and the Telephone Consumer Protection Act governing SMS. We follow NIST Cybersecurity Framework, OWASP, and ISO 27001 guidance, and work with a regulated banking partner subject to KYC and AML requirements.
Avoiding Phishing
Check the URL. The real site is https://hellosunset.com with a lock icon in the address bar. When in doubt, type it rather than clicking a link.
All our email comes from @hellosunset.com, and we use SPF, DKIM, and DMARC to prevent spoofing.
We will never ask for your authentication code. Anyone who does is not us.
Forward anything suspicious to [email protected] and we'll confirm whether it's real.
Your Part
Keep a passcode or biometric lock on your phone, since your number is your key to the account
Ask your mobile carrier about SIM swap protection
Update your phone number in Sunset if it changes
Log out on shared computers rather than just closing the tab
Avoid public Wi-Fi for this, or use a VPN
If several heirs need access, each should use their own login rather than sharing one
If Something Goes Wrong
No system is immune. If there's ever a breach affecting your information, we'll notify you promptly as required by law, tell you what was affected and what we're doing about it, and provide guidance on protecting yourself.
We'd rather tell you clearly than minimize it.
If you suspect unauthorized access
Email [email protected] with "SECURITY CONCERN" in the subject. We'll investigate login attempts and may temporarily restrict access while we verify your identity.
If your phone is lost or stolen
Contact your carrier immediately to suspend service, which stops anyone from receiving your codes, then contact us to update your number.
More Information
Our Security Center, with current certifications and controls
Privacy Policy at hellosunset.com/privacy
Terms of Service at hellosunset.com/terms
For security questions, chat with us in the app, call (385) 707-0082, or email [email protected].