Security
Security and trust posture
Factual controls, designed work, and customer responsibilities—without invented certifications or exploitable infrastructure detail.
Live controls
- Church/tenant isolation is a core server-side boundary.
- Authorization is enforced on the server for product records.
- Care and pastoral request data use tighter access than ordinary community content.
- Staff capabilities are role- and membership-based.
Designed or not yet enabled for marketing claims
- Commercial legal enforcement flags remain off pending counsel-approved cutover.
- Transactional email delivery is implemented but disabled in production configuration.
- Analytics collection and dashboards are design-only—not live commercial telemetry.
- Account deletion request paths exist behind flags and are not marketed as fully complete.
Customer responsibilities
- Churches remain responsible for safeguarding, pastoral judgment, and local emergency response.
- Staff must assign Care and admin roles appropriately.
- Churches should use their own processes for crisis situations.
Privacy and legal documents
Privacy and Terms pages are published for pilot framing. They should not be treated as final counsel-approved commercial contracts until review and enforcement cutover are complete. We do not claim SOC 2, HIPAA, FERPA, PCI, GDPR certification, uptime SLAs, or encryption guarantees beyond what counsel and evidence support.
Care limitations
Care is a request-and-follow-up workflow for authorized church staff. It is not emergency dispatch, medical service, counseling delivery, or continuous monitoring.
See ChurchHearth with your church in mind
Request a walkthrough of Church Admin and the member experience. Availability, package fit, and next steps are discussed directly—no automatic checkout.