Security and privacy
Your church’s data stays your church’s
What we do today to protect your church and your members, in plain words. We add to this page only when something is actually in place.
Each church’s data is kept apart
Many churches share one platform, and the database decides what each person can read or change, on every request. It isn’t left to the app’s screens. Automated tests check this separation on every change to the platform.
Who can see what
Your admins
They manage your church only, and each admin has permission only for the areas you give them. Your church can see a record of changes: who made each one, and when.
Other churches
They can’t see your members or your private content. A person who belongs to two churches shows each one only what they share with it.
Candlestick staff
- In normal running, we see your church’s usage, status and billing, not your members or content. We also see the themes typed into Asaph song searches, without who typed them or the words of any notes or slides.
- While we set up your church, our staff work in it as an admin, so we can build it with you. That ends when your church goes live.
- When you ask for help, your senior admin can give us access for 1 to 14 days, with a reason. Either side can end it early, and each grant goes in your church’s record.
Signing in
Admins use a second sign-in step, a code from an authenticator app, and the database refuses admin changes without it. Setting a password also asks for that code. If an admin loses their authenticator, our staff reset it only after checking, the reset goes in your church’s record, and the admin gets an email. Sign-up, sign-in and password resets have a check that stops automated attacks.
Your recordings and pictures
Before a recording plays, the platform checks that the person is allowed to hear it. Then it issues a link for that one file, which expires: at most 12 hours later. Your storage is your church’s own, and other churches can’t reach it.
Where your data is kept
The database is hosted in Europe, and recordings and files are kept in Cloudflare R2’s EU jurisdiction. Data is encrypted when it travels and when it’s stored. The platform terms say who helps us run the service.
Your data when you leave
Your senior admin can export your church’s data and members list at any time, with a list of your recordings and pictures. Members’ private things, such as their notes, messages and viewing history, aren’t in the export, because they belong to the member. What signing up means explains how closing an account works.
Report a problem
If you think you’ve found a security problem, email security@getcandlestick.com.