Names, homes, phone numbers, what people can afford to give, and when they lost someone. That is not ordinary business data, and it is not treated as such here.
We could not leak a card number if we tried â we never receive one.
Mandatory, enforced by the application regardless of any other setting.
Every request is authorised against one specific congregation.
Who did it, when, in what role â kept even for cancelled records.
Logins are handled by a managed identity service, not by password code we wrote. Passwords are never stored by us in any form.
Administrators and pledgers must enrol an authenticator app before they can reach anything. This is enforced in the application, so it cannot be switched off in a settings panel by mistake.
Every request is verified at the gateway before it reaches our code, and verified again inside the application. The gateway rejects anything unauthenticated outright.
Roles are checked on the server for every operation, never assumed from what the screen offered.
The platform serves several congregations. Keeping them apart is not a filter applied at the end of a query â it is the first thing checked and the last thing enforced.
A bookkeeper who works for two shuls, or a family who belong to one and give to another, can hold one login for both. What is shared is the login and nothing else.
Card details are captured in fields that belong to the payment processor, inside the payer's own browser, and exchanged for a token there. The card number never travels to our servers, is never written to our database, and never appears in a log.
A public donate page is a target. It is treated like one.
Sensitive public payment endpoints only accept traffic from the country your congregation is in. Card-testing farms abroad never reach the form.
Public payment submissions must carry a proof-of-browser token. Real visitors never see a puzzle; automated traffic cannot produce one.
Per-address limits on both the portal and the public API, plus request throttling at the gateway, so no single source can flood or grind through it.
Public forms carry a field no human ever sees. Anything that fills it in is rejected before a card is charged.
Website files are served through a CDN from storage that is not reachable from the internet directly. Certificates renew themselves.
The anonymous public API can read only whitelisted content and write only payments. It has no code that can return a member record.
The convenience members like most is also the easiest thing to get dangerously wrong. A link that shows a balance has to prove who it is for.
In a volunteer-run office with changing staff, being able to reconstruct what happened matters more than in most businesses.
Your data can be restored to any moment in the recent past, not just to last night's backup.
Everything is mirrored to a second geographic region, so a regional outage is not an existential event.
Any bulk operation â an import, a correction, a migration â is dry-run first and backed up before a single row is written.
Everything stored is encrypted on disk. Everything moving is encrypted in transit. Secrets â processor keys, signing keys â live in managed encrypted storage with their own access controls, never in code, never in a configuration file, never in the repository.
Security pages that claim everything are worth nothing. Here is where the honest edges are.
Reviewing this for a board or a security-minded congregant? Ask us anything â we would rather answer the hard question now than after you have signed.
We will happily get on a call with whoever in your community worries about this properly.
