For Employers · For your legal team
Security and data,
in writing.
The page to forward to legal, security, or procurement. The short version: employees own their accounts, employers see aggregate numbers only, and we don’t claim certifications we don’t hold.
What can the employer see about an employee’s use of MORTL?
Aggregate numbers only: how many employees activated, overall checklist progress, and which tools get used across the group. The reporting is built so it can’t reach an individual’s plan, documents, answers, or activity.
Who owns the employee’s account and data?
The employee. They create their own account with their work email, and what they put in it belongs to them. The employer pays for access and gets no rights to the contents. MORTL doesn’t sell personal information.
What happens to employee data if the program ends?
Accounts and saved planning data stay with the employee. Premium features lapse to the free tier, and the someone-just-died path stays free for everyone permanently. Nothing gets handed to the employer and nothing gets deleted out from under the employee.
What data does MORTL collect and which providers process it?
The privacy policy lists the categories and the service-provider roles: hosting and storage, authentication, payment processing, and transactional email. It applies to employer-sponsored accounts exactly as it does to individual ones.
How are uploaded documents handled?
Document uploads are stored encrypted at rest by the storage provider and connections use HTTPS. MORTL also tells users directly not to store Social Security numbers, account passwords, or seed phrases in planning notes, and the guidance in the product is written to keep them out.
Does MORTL have SOC 2 or ISO certification?
No. MORTL is a small company. We answer security questionnaires honestly and quickly, we review DPA requests, and if a control you need is missing, we’ll tell you before you sign.
What happens if there’s a security incident?
MORTL investigates, fixes the problem, and notifies the program contact and affected users as applicable law requires.
What does implementation require from IT?
Approving your work-email domain. Employees activate themselves by signing in with a work email; there’s no roster upload, no SSO integration, and no software to install. If your security review needs more than that, bring it to the founding call.
More for employers