How we keep your data safe

Draft: to be reviewed before launch.

How Church Member Software looks after your church's data.

Where your data is kept

• All church records are stored in the UK (London).
• Emails are sent through Amazon in the EU (Stockholm, Sweden). UK data protection law recognises the EU as giving equivalent protection.
• Data is encrypted while it travels between your browser and our servers, and while it is stored.
• Backups are encrypted and kept in the UK.

Keeping churches apart

• Every church's records carry a church identifier, and the database itself refuses to show or change one church's records when working for another. This is checked by automated tests on every change we make.

Signing in

• Passwords must be at least 12 characters, and are checked against lists of passwords known to have leaked (without sending your password anywhere).
• Administrators, staff and treasurers must use two-step sign-in with an authenticator app.
• Repeated failed sign-ins are slowed down. Passwords are stored using a one-way hash and are never emailed.
• Members sign in to the member area with single-use emailed links. Team members can't use these links.

Who can see what

• Each person on your team has a role. Counters can enter gifts without seeing anyone's giving history. Staff can't see giving. Group leaders only see their own groups.
• Pastoral and safeguarding notes can be limited to named people.
• An audit log records sign-ins, changes, exports and sensitive actions. It can't be edited or deleted.

Our staff

• We don't look at your church's data unless you ask us to help with something, and then only for as long as needed.

If something goes wrong

• We will tell you without undue delay, and within 48 hours, if we become aware of a breach affecting your church's data, so you can meet your own 72-hour duty to tell the ICO if needed.