How we protect your information
Last updated: 26 September 2026
Trusting anyone with the details of one of the hardest times in your life is a big thing to ask. Here is how we look after what you share with us, in plain language.
In short: your documents are encrypted and stored in Australia. We never sell your information. What you store is private to you and the people you choose to share it with. You can download your documents and close your account at any time. If something ever went wrong with your data, we would tell you. Our security is certified against a recognised Australian standard.
Your documents stay in Australia
The documents you keep in your vault, and your account register, are stored in Australia, on secure servers in Sydney. Some of the services we rely on to run the platform, like sign-in, payments and email, are provided by trusted companies based overseas. When that happens, we take reasonable steps to make sure your information is protected to Australian standards. You can see the full list in our Privacy Policy.
Everything is encrypted
Your information is encrypted while it travels between your device and us. The documents you keep in your vault, like a will or an advance care directive, are also encrypted while they are stored. Encryption scrambles information so it cannot be read by anyone it is not meant for.
Your information belongs to you
You are always in control of what you share. You can download the documents in your vault and close your account at any time. We will never sell your information, and we will never hand it to advertisers.
Who can see what is yours
What you store stays private to you and the people you choose to share it with. Every request made from a signed-in account is checked against that account before anything is returned, so that one member's records are not shown to another. Some links work without signing in, such as a medication diary share link you create, or the link your legacy contact uses. A medication diary link switches off on its own if it is not opened for 14 days, and you can withdraw any of these links from your account at any time.
The small team that runs 18December can see some details of your account when that is needed to support you or to run the platform, such as your billing, who you have shared with, and the names of the documents in your vault. We do not open the content of your documents unless you ask us to help with them, or the law requires it. Actions we take on an account through our admin tools are recorded in a permanent log.
We keep our own doors locked
The accounts we use to run 18December are protected with multi-factor authentication and passkeys, so they cannot be reached with a stolen password alone. We treat everything you share as confidential.
Our security is certified against an Australian standard
In July 2026, 18December was certified to the SMB1001:2026 Level 3 (Gold) standard by CyberCert. It means the way we protect your information has been measured control by control against a recognised Australian standard, rather than left to good intentions. At this level of the standard, the controls are confirmed by a formal attestation from our director, which carries legal weight, rather than by an outside auditor. That is worth being clear about. You can view our certificate.
We help protect you from scammers
We have set up email authentication on our domain. In plain terms, this makes it much harder for anyone to send you an email pretending to be from 18December. If a message claiming to be from us ever looks off, trust your instinct and check with us first.
If something ever goes wrong
No one can promise nothing will ever happen. What we can promise is honesty. We have a written plan for responding quickly to any security problem, including telling you promptly if your information is affected and what to do next. This is also our obligation under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth).
Questions
If you ever want to understand more about how your information is handled, read our Privacy Policy or email us at hello@18december.com.au. A real person will answer.