Loading
Security and privacy
A church directory is the most sensitive list most churches keep
Addresses, children, family situations, safeguarding records. Every promise below names something enforced in code rather than something intended, and the ones that are not enforced yet are listed further down instead of left out.
Enforced today
What the code will not let happen
These are not settings an administrator can get wrong. They are properties of the way data is reached, which is why they are worth stating separately from the feature list.
One church cannot read another
Every query is built from a scope that can only be minted from a verified session — never from anything in a request body, query string, path or header. Route handlers are blocked from reaching the database directly by a lint rule, not by a convention, and the cross-tenant isolation tests block a release rather than warn about one.
Every change is recorded, automatically
Auditing is middleware on the API rather than code each feature remembers to call, so a new endpoint is audited the day it is written and no module can opt out. Sensitive values are redacted in the record; the fact that something changed, and who changed it, never is.
Children never get accounts
Nobody under thirteen is ever a login. Their records are managed by a guardian, photo consent is a flag that is honoured everywhere a photo renders, and kids check-in data — allergies, authorised pickups — is held at the sensitive tier, which needs an explicit grant to read.
Privacy is per person, not per church
A member can be in the directory without being in the directory: opt-in is per person, and visibility is per field, so somebody can share a name and withhold a phone number. Pastoral notes are a separate permission tier from general notes, even for administrators.
Sessions that a database dump cannot reuse
Sign-in is invitation-bound — a Microsoft account attaches only to a user record your church already created — so nobody can claim an account by controlling an email address. Sessions are short-lived, and only a hash of the token is stored, so reading the database never yields a working credential.
Email that follows the law it is subject to
Scheduling requests and receipts are transactional; newsletters and announcements are bulk, carry one-click unsubscribe, and respect per-person communication preferences. Treating those two as one thing is how a church ends up in a spam folder and in breach at the same time.
Not yet
What is still on the list
Published here rather than discovered later. A security page that only lists what works is a security page that has decided which half of the truth is convenient.
Open items
Each of these is work in progress rather than a decision. When one closes it comes off this list.
- Two-factor authentication is not enforced yet
- The design requires TOTP for Owner and Org Admin and makes it optional for everyone else. Sign-in with Microsoft is live and inherits whatever your organisation already enforces there; the product’s own second factor is not built, so a deployment relying on a passcode rather than Microsoft has one factor.
- Reading a sensitive field is not yet in the trail
- Permission tiers already stop a pastoral note or a background-check result being read without an explicit grant, and redact it otherwise. What is not built is the other half: a permitted read of one of those fields should itself be an audited event, and today it leaves no record.
- There is no staging rehearsal
- One deployed environment, which is production. That is a deliberate trade while the only data in it is a demo fixture, and it is the thing that changes before a real congregation is on the platform rather than after.
- No church is live on it yet
- The most important context for everything above. This is an early product with a published plan, not a system with ten years of incidents behind it. If you need the latter today, we would rather tell you now.
Ask us the awkward questions
If your church has a safeguarding policy, an insurer or a trustee who needs satisfying, tell us what they need to hear and we will answer it straight — including where the answer is “not yet”.