Every repatriation case managed by Eternal Horizon is logged against a structured milestone pipeline — from Case Initiated through Mortuary Preparation, Transport Scheduled, In-Transit, Customs Clearance, and Final Arrival. Each milestone update is timestamped and written simultaneously to our Supabase database and our audit ledger, creating an immutable chain of custody.

Families and authorised insurers receive automatic SMS and WhatsApp notifications at each milestone. Transport partners submit GPS-verified movement events (hospital pickup, embalming transfer, Changi Cargo handover) directly from their mobile devices, with latitude, longitude, and accuracy metadata recorded against each event. These coordinates are rendered on an interactive live map accessible via the family tracking portal.

Air Waybill numbers are sensitive commercial logistics identifiers that link the deceased's remains to a specific cargo consignment. At Eternal Horizon, AWB data is:

• Stored exclusively within our encrypted Supabase database, protected at rest using AES-256 encryption. • Transmitted only over HTTPS/TLS 1.3-secured connections — never exposed in plaintext URLs or unencrypted email bodies. • Accessible only to the assigned case administrator and the authorised transport partner via role-based access control (RBAC). • Cross-referenced in real-time against TrackingMore's cargo API to provide live flight status updates to the family without exposing the raw AWB identifier to the public-facing portal.

The AWB record is retained as part of our permanent logistics ledger for insurance and customs audit purposes even after privacy purging of personal identification documents.

In full compliance with Singapore's Personal Data Protection Act (PDPA) and international best practices for sensitive biometric and identity data, Eternal Horizon operates an automated, time-bound data destruction pipeline:

TRIGGER: When a case milestone reaches "Final Arrival", the system automatically stamps a closed_at timestamp in our database.

RETENTION WINDOW: 14 calendar days from case closure. This window allows time for any final insurance claim submissions, embassy confirmations, or family requests before irreversible deletion.

PURGE EXECUTION (automated, daily at 2:00 AM SGT): Our background purge system identifies all closed cases older than 14 days and performs the following irreversible actions: → Permanently deletes death certificate scans from cloud storage → Permanently deletes passport and NRIC/identity document files from cloud storage → Nullifies the deceased_nric, death_certificate_number, and nric_passport database fields

WHAT IS RETAINED (permanent logistics archive): ✓ Deceased name (for memorialisation records) ✓ Flight number and flight date ✓ All historical milestone and movement event logs ✓ Case reference and tracking ID ✓ Origin and destination countries

Once the shredding routine completes, a privacy_purged_at timestamp is written and the case is permanently excluded from future purge cycles. This process cannot be reversed.

All documents submitted by families — including Letters of Authorization (LOA), death certificates, and identity documents — undergo the following security handling:

• Upload Encryption: Files are transmitted over HTTPS directly to Supabase's private storage bucket with no intermediate server handling. • Access Control: Document URLs are not publicly accessible. Retrieval requires a signed, time-limited URL generated only for the authenticated case owner, assigned partner, or administrator. • AI Verification: Uploaded documents are cross-checked by our AI document scanner against the required document checklist for the specific repatriation corridor (e.g., Singapore → Malaysia), flagging missing or mismatched documents for admin review. • Drive Sync: With client consent, verified documents are synced to a case-specific Google Drive folder accessible exclusively to the assigned case team.

Families are provided a unique Tracking ID (e.g., EH-DECEASEDNAME) at case initiation, enabling access to the public movement monitoring portal without requiring a login.

The portal displays: • Current case milestone and status note • Full timeline of visible tracking events • GPS movement map for transport partner events • Estimated arrival date and flight details (where applicable) • Daily Progress Reports prepared by the case manager

Sensitive information — including NRIC numbers, death certificate details, cost breakdowns, and internal partner notes — is never exposed in the family-facing portal. A dedicated B2B portal with password authentication is provided separately for insurer and partner agency access.

Eternal Horizon's technology infrastructure is built on enterprise-grade, Singapore-compliant foundations:

• Database: Supabase (PostgreSQL) with row-level security (RLS) enforced on every table — each user and partner can only query the exact rows they are authorised to view. • Authentication: All admin and partner sessions use token-based authentication with short-lived JWT tokens. • Audit Logging: Every case update, document upload, partner assignment, and purge event is logged to an immutable AppErrorLog audit table with source, severity, timestamp, and context. • Error Monitoring: A background health-check function runs every hour to detect and alert on system anomalies. • PDPA Compliance: Our Data Protection Officer (DPO) is contactable at dpo@eternalhorizon-singapore.com. Clients may request access, correction, or deletion of their data at any time within the 14-day retention window.