Back to homeSecurity & data
Your church’s data is yours — and it’s protected
Church data is sensitive: who belongs to which congregation, pastoral notes, children. So here are specifics, not reassurances — who sees what, where it is stored, and how you take everything with you if you leave.
Who sees what
Everyone sees only what their role allows.
- Ready-made roles — owner, administrator, pastor, treasurer, team member, church member — plus your own roles.
- A ministry leader edits only their own team, not the whole church.
- Finance is a separate access level: a pastor can see totals without seeing who gave what.
- “View as role” — before granting access you see the console through that role’s eyes.
- Activity log: who changed what, and when.
Backups and restore
A mistake or an accidental delete is not a disaster.
- The database is copied nightly to separate storage.
- On top of that, the database can be restored to any moment in the last 30 days — we do this for you on request.
Where it is stored
On Cloudflare’s infrastructure — the same that serves millions of websites.
- All traffic runs over HTTPS and the database is encrypted at rest.
- The database lives in Cloudflare’s European region.
- Passwords are never stored in the clear — only a cryptographic hash (PBKDF2). Even we can’t recover a password; it can only be reset.
- Each church’s data is separated from every other church’s at the level of every request.
What never becomes public
Your church website is filled from the console — but not from everything.
- Children’s photos, private phone numbers and addresses, giving amounts and names from prayer requests never reach the website.
- Public forms — join, prayer, group sign-up — are protected from bots by a captcha and rate limits.
What we do with AI
AI is a tool, not a leak.
- No AI model is trained on your church’s content.
- When you run an AI feature, the provider receives only what that feature needs.
- If you don’t use AI, nothing goes to AI providers.
Everyone sees their own data
Not just the administrator.
- “My data” is open to everyone with an account: their profile, form answers, groups, family, attendance and their own giving.
- Spotted a mistake? “Report” creates a task for the administrators, and the profile keeps a trace of why it changed.
You can leave
We don’t hold your data hostage.
- Export people, finance, reports and donor statements any time — as CSV, Excel or PDF.
- When a subscription ends, the account becomes read-only: nothing is deleted or hidden.
- A domain registered through us is handed over to you on request, free of charge, within 10 business days.
Questions about your data?
Write to us — we’ll answer to the point. Or try it yourself: 30 days free, no card.