Security
For the person on the board who asks the technical questions.
The home page says your data stays yours and stays here. This page is the detail behind that sentence, written for whoever is asked to check it — and it names the gaps as well as the guarantees.
Jurisdiction
- Your members’ records are held under Malaysian law and handled under the PDPA.
- The people responsible are in your time zone.
Separation between churches
- Each church’s data is fully isolated. A church cannot see, search or report on another church’s people.
- Churches are created by hand, one at a time. There is no self-serve tenancy.
Who can see what
- Six roles, enforced in the code at the point of action — not by hiding a menu item from a user who could otherwise reach the page.
- Giving is administrator-only. Staff accounts cannot see finances at all.
- Children’s medical detail is separated from running the check-in desk.
- Granting access is administrator-only.
- A group leader takes their own group’s register and sees nothing else. A team coordinator gets the rota and nothing else in the office. A member sees only the portal.
- Limit: a coordinator’s rota access is not yet narrowed to one team. They can build any team’s rota.
Signing in
- Passwordless. A single-use link by email — nothing to reuse across sites, nothing to phish out of a member, nothing to reset.
- Invite-only. Nobody can create an account; the office adds a person.
- The member portal is a web app installable to a phone home screen. There is no separate store app to keep patched.
Audit trail
- Every check-in and collection action is logged — including a release to someone who was not on the authorised list, with who collected, why, and in whose name.
- Exports of the people directory, the giving ledger and an event’s sign-ups are written to an export log: who exported what, and when.
- Limit: the attendance and children’s-register exports are not yet logged. Both are office-only and role-gated; neither writes an audit row.
- Deleted people are tombstoned rather than silently vanished, so the trail survives the deletion.
What a member can do
- See and download everything the church holds on them.
- Request deletion. The office gets a queue with the 30-day clock already running.
- A child’s record is never included in another member’s download.
Getting out
- Full CSV export of people, attendance, giving and the children’s register, from inside the app, without asking us.
- No contract to exit.
- If we were ever unreachable, your data is still yours and still exportable by any of your own administrators, without us. Our terms commit us to at least 90 days’ written notice and a complete export before the service could be withdrawn.
Still not answered?
Send the question. A technical answer from the people who wrote the code, within three working days — and if the answer is “no, ChapelHQ doesn’t do that”, you will get that instead of a brochure. Ask directly or write to hello@chapelhq.com.
Tell us about your Sundays.
How many people, how many services, and which part of the admin takes the most time. A person reads every enquiry, and replies within three working days.