Security & Trust

Churches trust StGatherly with sensitive information about their people. We treat that responsibility seriously and design the platform with security and data protection built in, not bolted on. This page describes the measures we use. It is written for church leaders, administrators, and the finance and operations teams who assess software on their behalf.

The StGatherly application runs on Microsoft Azure in the United Kingdom, and church data is stored in our Supabase database in the United Kingdom (London). Both are leading providers with strong physical and operational security, and our infrastructure is managed through hardened, access-controlled cloud services rather than self-managed servers.

Data is encrypted in transit using industry-standard TLS. [CONFIRM: encryption at rest (confirm scope: database, backups, file storage)]

Each church is a separate tenant. Data is logically separated so that one church’s information is not accessible to another. Every request is scoped to the church it belongs to.

• Role-based access controls with least-privilege by default.
• Access to production data by our team is limited to what is needed to operate and support the Service, and is logged.
• Authentication controls, including secure session handling.

We use a small number of trusted third parties to deliver the Service. We do not sell personal data. The current list, including each provider’s role and location, is on our sub-processor page, and our processing obligations are set out in our Data Processing Addendum.

[CONFIRM: backup frequency, retention, and recovery approach; uptime/availability target if you intend to commit to one]

The Service gives churches tools to manage their congregation’s data responsibly, including exporting, correcting, and deleting member records so they can meet requests from the people they serve. Where a church acts as controller, it remains responsible for consent and lawful basis; we support it as its processor.

If a personal data breach affects data we process on a church’s behalf, we will notify the affected church without undue delay, with the information it needs to meet its own obligations. Our commitments as a processor, including timing, are set out in our Data Processing Addendum.

We welcome reports from security researchers. If you believe you have found a vulnerability, please follow our Vulnerability Disclosure Policy.

We build in line with UK GDPR and the Data Protection Act 2018. [CONFIRM: certifications held and roadmap, e.g. SOC 2 / ISO 27001 status] We are happy to work with churches and denominations that have their own security and procurement requirements.

For security questions or to request further documentation, contact hello@stgatherly.com.