Security that's boring on purpose.
Security is ChurchPlan's top priority — above features, above speed, above margin. Your members' records and your parish's money ride on the same plumbing banks and major retailers use: encrypted, access-controlled, and never more exposed than they have to be.
Security is not a line item we trim.
Plenty of software is built cheap and priced accordingly — and security is where the savings quietly come from. We made the opposite bet.
Funded first, cut never
Security is the first line in our engineering budget and the last thing we would ever trade to protect margin. No corner-cutting, no “good enough for now,” no deferred hardening.
Built by people who've done it at scale
Our engineers protected data at Apple, Google and Shopify before they protected yours. The habits came with them: least privilege, defense in depth, and assuming the worst day will come.
Written down, not just claimed
Every commitment on this page also lives in our Privacy Policy and church agreements — encryption standards, access controls, audit logging, and breach-notification duties you can hold us to.
The market is right to ask hard questions.
Churches have watched trusted platforms get breached. In recent years, skimming code has sat hidden inside the checkout pages of well-known software companies for months — silently harvesting names, addresses and card numbers before anyone noticed. The lesson isn't that one vendor failed. It's that security is a budget, and systems built cheap fund it last.
There's nothing here to skim
ChurchPlan never stores credit card numbers or full payment credentials. Every payment is tokenized by PCI-compliant processors — Stripe, Apple Pay and Google Pay — so card data never touches ChurchPlan's servers. A vault that doesn't exist can't be breached.
Subscriptions pay for security
“Free” and cheap systems have to make the money back somewhere — and security spend is the easiest thing to quietly skip. ChurchPlan is funded by church subscriptions, so protecting your data is what the revenue is for, not what it competes with.
Logged, monitored, disclosed
Authenticated activity is logged, security logs are kept on a 12-month rolling basis, and if a breach ever put your people at risk, we notify regulators and affected members within legally required timeframes — as fast as 72 hours where the law demands it.
“A new platform doesn't get the benefit of the doubt on security. It has to earn it — in architecture, in spending, and in writing.”
Read it like a ledger.
Fewer places to fail. Nothing to leak.
Money on regulated rails
StripePCI DSS L1Every card payment — gifts, tickets, campaigns — is processed by Stripe, a certified PCI DSS Level 1 provider. Card numbers go from your member's device to Stripe; ChurchPlan stores references, never card data. There is no card vault here to breach.
Passwords & sessions done right
bcryptHTTP-only cookiesPasswords are stored using bcrypt hashing — ChurchPlan never sees or stores your password in plain text. Sessions are protected with secure, HTTP-only cookies, expire automatically, and are immediately invalidated the moment a user's role or permissions change.
Access that follows the role
Admin · Priest · PastorMinistry rolesPermissions live with people, not in a settings maze. A youth leader sees their group; the treasurer sees finance; health and emergency details surface only to the roles that need them, like an event's supervisors. Email verification is required before sensitive features unlock.
Isolated by architecture
Never pooledYou own your dataEach church's records are isolated at the database level. There is no shared member pool, no cross-church directory, no back door — the only things that travel are events you deliberately publish. How privacy works →
An audit trail with teeth
Activity logging12-month security logsAuthenticated activity on the platform is logged, giving administrators visibility and accountability inside their own organization. Security and system audit logs are retained on a 12-month rolling basis and stand as evidence for any investigation.
Children & sensitive data, guarded harder
Age verificationParental consentHealth notes, pastoral-care records and anything involving minors are treated as sensitive by design — stricter access controls, tighter retention, date-of-birth age verification, and parent/guardian consent workflows built into events and activities.
No ad-tech in the sanctuary
No pixelsNo fingerprintingChurchPlan uses no third-party advertising cookies, no behavioural or cross-site tracking, no social-media pixels, and no fingerprinting — on the website or in the app. Cookies exist for sign-in and security, and that's where it ends.
Resilient by default
Automated backupsRegional residency · EnterpriseData is backed up automatically and stored redundantly. Dioceses and networks with residency requirements can keep their data in-region on the Enterprise plan.
Compliant across borders
PIPEDAGDPRCCPAAU Privacy ActNZ Privacy ActPrivacy statutes on three continents are the floor, not the ceiling. Receipting meets CRA, IRS, ATO and NZ IRD standards — see Privacy & Trust for the legal-compliance details.
Every claim here is a written commitment.
Encryption, isolation, logging, breach notification — they're spelled out in our Privacy Policy and in the agreements every church signs, so they're promises you can enforce, not slogans you have to trust.
Ask us the hard questions.
Diocesan IT review? Security questionnaire? We enjoy those. Fifteen minutes with our engineers — the people who built it, from Apple, Google and Shopify.