Who can read your will?
Short answer: you, and after your passing the successors you name. Not our staff. This page explains, in plain words, how that is done and where the limits are.
Three layers, in one picture
- On the way to us — every page and every upload travels over HTTPS (TLS). Nobody on the Wi-Fi, at the café or at the phone company can read it in transit.
- Where it is stored — your will PDF, your uploaded papers and the files on your life map are encrypted at rest with a key that is kept separately from the data (AES-256-GCM). A copy of the raw storage alone is useless without the key.
- Sealed on your own device — your private letters, the private message, your password vault, your estate map and the milestones you mark private are encrypted inside your browser before they leave it. They arrive at us already locked. This is turned on automatically for every new member; older members can turn it on from Manage my page.
Who holds the key to the sealed things?
Your key is made on your device and locked with your password. The server never sees your password — only a locked copy of the key that your password opens. There are two ways to run this; you choose:
You unlock with your password. After your passing, your successors unlock by signing in — no code to lose. To make that possible, a second copy of your key is kept in our vault, itself encrypted with the separate storage key. Our staff have no screen, button or tool that opens it; it is handed over only by the hand-over process your successors go through.
No copy of your key is kept anywhere. Your family unlocks with a code printed on the sheet kept with your will. With this choice not even Islamic Souls can read your private words — and if the password and the code are both lost, neither can anyone else. Switch in Manage my page → Encryption.
What is not sealed, and why
- Your public memorial or living page — name, dates, story, public photos — is meant to be read, prayed over and shared.
- Your will PDF and uploaded papers are encrypted at rest (layer 2) but not sealed in your browser, because your executor and successors must be able to download them the day they are needed, even if they never knew your password.
- Your email, name and billing details are stored privately so we can sign you in and charge the plan you chose. Card numbers never touch our servers — they are typed into Square's secure payment form, and Square keeps them.
- Your family tree is shared with the relatives you invite; cards you mark private stay out of public view.
Where it lives and how it is backed up
The site and its storage run on Netlify in the United States. Every night, an encrypted copy of all storage is written to a second provider in a different company's data centre, in a bucket that cannot be altered or deleted for 30 days after it is written — so a mistake, an attack or a billing problem at one provider does not take your family's words with it. Backups are encrypted exactly like the live data; the key is not stored with them.
After you pass
One of your successors reports your passing and proves who they are with a code sent to the email or phone you listed for them. You are emailed (and texted) a one-tap "I'm alive — cancel" link, and nothing moves until the waiting period you chose has passed — from 24 hours to three months (72 hours for free accounts). That wait binds everyone, our staff included. Only then do your page, will and sealed items open for your successors — and only them. Each private letter opens only for the person you addressed it to. Nothing is published that you did not mark public.
If Islamic Souls ever closes
We will email every member and family at least 90 days ahead and give them a download of everything — stories, photos, videos, letters and the will — so nothing is lost. This promise is also in our Terms.
Delete everything, any time
From Manage my page you can download your will and delete your account. Deleting removes your page, files and sealed items from live storage immediately; the nightly backups age out on their own after 30 days.
What we do not do
- No advertising networks, no tracking pixels, no selling or sharing of your information. The only outside services on the page are the ones that do a job for you: payment (Square), the Qur'an recitations, the translator and the fonts.
- No one at Islamic Souls — including the owner — can open your sealed letters, vault or private milestones with any admin tool. There is no such tool.
- We never ask for your password by email or phone, and we never need it.
Honest limits
- A lost password locks you out of your sealed items. With the Simple setting we can reset your sign-in, and your sealed items open again after you sign in with the emailed link. With the Strict setting, only your family code can open them.
- Your own device is part of the chain. A phone with malware, or a shared computer left signed in, can read what your browser can. Sign out on shared devices.
- Encryption at rest protects a stolen copy of the storage, not the running site itself. That is why there are the extra layers: sealing on your device, a separate key, off-site backups, and a second step (an emailed code) for our own admin sign-in on any new device.
Who we are
Islamic Souls is operated by Islamic Souls LLC, a Michigan limited liability company in Dearborn Heights, Michigan, USA. Questions about any of this: info@islamicsouls.com. Our Privacy Policy lists exactly what we collect, and our Terms set out our obligations to you.