REGULATORY COMPLIANCE

Data Governance and Compliance Standards.

Our technical and operational standards are designed to protect your congregation's privacy and institutional sovereignty.

Compliant with international data privacy frameworks and applicable national data protection acts.

Strict multi-tenant architecture ensuring complete data segregation between churches.
Data collected is processed solely for providing management services to subscriber churches.
Churches retain 100% legal ownership of their member, financial, and attendance records.
Opt-in and explicit consent workflows for communications and children check-in records.

Enterprise security controls maintaining strict confidentiality and system integrity.

Encryption in Transit: All endpoints use TLS 1.3/HTTPS encryption with HSTS.
Data Isolation: Application-layer tenant validation header (x-church-id) enforced on every API transaction.
Access Controls: Strict Role-Based Access Control (RBAC) ensuring staff see only assigned domain data.
Credential Protection: Salted bcrypt password hashing; JWT tokens with configurable expiration.

Empowering church administrators with complete control over their organizational records.

Right to Access & Export: Administrators can export membership and financial records in standard formats (XLSX, CSV, PDF).
Right to Erasure: Soft and permanent deletion options for member profiles upon formal request.
Database Backups: Automated daily database snapshots with disaster-recovery failover.

Tier-1 sub-processors contractually bound to maintain strict security safeguards.

Payment Processors: Paystack and Mono for payment collection (PCI-DSS compliant).
Media & Asset Storage: Cloudflare and AWS S3/R2 with regional replication.
Communication Gateways: Arkesel and Resend for transactional SMS and email delivery.
Monitoring: Sentry for runtime application error telemetry without logging PII.