The rules that keep your church's data yours.

Every table holding church data carries a churchId, resolved from your authenticated session — never from a URL, form field, or API parameter a browser could tamper with.

A person’s attendance, giving, or messages are linked to their church through the database's own foreign keys, so a record can't attach itself to the wrong church.

Code that queries church data without a concrete church id throws an error instead of quietly returning every church at once.

Every update or delete names its church id in the same database query. A missed permission check still can’t reach another church's row.

If your account ever reaches for another church's data — a guessed id, a stale link — the response is the same "not found" you’d get for a record that never existed. We don’t confirm another church's data exists.

Server-side changes re-verify permissions independently of what the screen already checked, and record who did what in an audit log.

Removed records are soft-deleted within your church's own data and excluded from active views — never exposed to another church.

Support-tier staff cannot open a church's workspace at all. Only audited, senior access can enter a tenant workspace, and every entry is logged.

When data moves in bulk for operational purposes, the audit trail records how many records moved — never the records themselves.

Report anything that looks exploitable to info@churchgrid.app, the mailbox published in /.well-known/security.txt. A useful report names the affected page or route, what an attacker could gain, and the steps or proof-of-concept that reach it. Test only against your own church workspace — never probe, access, or test against another church's data.

Every report is acknowledged within five business days of arriving at the mailbox. As triage moves, the reporter is kept informed: what was confirmed, what is being fixed, and what to expect next.

Research carried out in good faith under this policy will not be met with legal action from us. In exchange, the work stays inside these lines: no degrading the service, no accessing or exfiltrating anyone's data beyond what the report itself requires, no ransomware or extortion demands, prompt and confidential reporting, and no public disclosure before the agreed timeline.

Disclosure is coordinated: the aim is a fix published and the finding disclosed within ninety days of the report, or a different timeline agreed with the reporter. Extensions happen only for the sake of the fix, and they are communicated.

The platform operator who owns info@churchgrid.app triages each report, severity first, routes it to a fix, and stays the reporter's single point of contact.

Files are checked against a fixed list of unsafe signatures. This is not an antivirus engine; packed or obfuscated malware can pass. Upload files only from sources you trust.

Questions about data isolation? Email privacy@churchgrid.app.