Security
How ChapelHQ handles your church’s data.
Where records are hosted, how access works, and what your church can export. Current limitations are listed alongside the controls, not left out.
Hosting and suppliers
Scroll sideways to see all hosting details.
| Service | Provider | Function | Processing location |
|---|---|---|---|
| Database | Supabase (PostgreSQL) | Stores church records | Singapore (ap-southeast-1) |
| Application | Vercel | Runs ChapelHQ | Singapore (sin1) |
| Resend | Sends service messages | United States (stored email data) |
The production database and application are configured in Singapore. Resend stores email data, including message content and delivery logs, in the United States; its sending region is separate from storage location. Malaysian legal jurisdiction is a separate question from where each supplier processes data.
Access, by role
Access depends on the role assigned to each person. The views below explain what each role can see or manage.
Church administrator
- People records
- Allowed
- Giving
- Allowed
- Serving schedules
- Allowed
- Group attendance
- Allowed
- Children's information
- Allowed
- Access administration
- Allowed
Staff
- People records
- Allowed
- Giving
- Not availableFinances are admin-only.
- Serving schedules
- Allowed
- Group attendance
- Allowed
- Children's information
- RestrictedCheck-in and allergy alerts only — medical notes and date of birth are admin-only.
- Access administration
- Not availableGranting access is admin-only.
Group leader
- People records
- Not available
- Giving
- Not available
- Serving schedules
- Not available
- Group attendance
- RestrictedTheir own group’s register only.
- Children's information
- Not available
- Access administration
- Not available
Team coordinator
- People records
- Not available
- Giving
- Not available
- Serving schedules
- AllowedNot yet narrowed to one team — a coordinator can build any team’s rota.
- Group attendance
- Not available
- Children's information
- Not available
- Access administration
- Not available
Member
- People records
- RestrictedTheir own record, from their profile.
- Giving
- RestrictedTheir own giving history only.
- Serving schedules
- RestrictedTheir own assignments and replies only.
- Group attendance
- Not available
- Children's information
- Not available
- Access administration
- Not available
Internal support / platform access
- People records
- Not available
- Giving
- Not available
- Serving schedules
- Not available
- Group attendance
- Not available
- Children's information
- Not available
- Access administration
- Not available
View the full comparison table
| Role | People records | Giving | Serving schedules | Group attendance | Children's information | Access administration |
|---|---|---|---|---|---|---|
| Church administrator | Allowed | Allowed | Allowed | Allowed | Allowed | Allowed |
| Staff | Allowed | Not availableFinances are admin-only. | Allowed | Allowed | RestrictedCheck-in and allergy alerts only — medical notes and date of birth are admin-only. | Not availableGranting access is admin-only. |
| Group leader | Not available | Not available | Not available | RestrictedTheir own group’s register only. | Not available | Not available |
| Team coordinator | Not available | Not available | AllowedNot yet narrowed to one team — a coordinator can build any team’s rota. | Not available | Not available | Not available |
| Member | RestrictedTheir own record, from their profile. | RestrictedTheir own giving history only. | RestrictedTheir own assignments and replies only. | Not available | Not available | Not available |
| Internal support / platform access | Not available | Not available | Not available | Not available | Not available | Not available |
| Role | People records | Giving | Serving schedules | Group attendance | Children's information | Access administration |
|---|---|---|---|---|---|---|
| Church administrator | Allowed | Allowed | Allowed | Allowed | Allowed | Allowed |
| Staff | Allowed | Not availableFinances are admin-only. | Allowed | Allowed | RestrictedCheck-in and allergy alerts only — medical notes and date of birth are admin-only. | Not availableGranting access is admin-only. |
| Group leader | Not available | Not available | Not available | RestrictedTheir own group’s register only. | Not available | Not available |
| Team coordinator | Not available | Not available | AllowedNot yet narrowed to one team — a coordinator can build any team’s rota. | Not available | Not available | Not available |
| Member | RestrictedTheir own record, from their profile. | RestrictedTheir own giving history only. | RestrictedTheir own assignments and replies only. | Not available | Not available | Not available |
| Internal support / platform access | Not available | Not available | Not available | Not available | Not available | Not available |
The platform account manages trial dates and billing bands across churches. It cannot open a church’s people, giving, rota, attendance or children’s records.
Signing in
- Passwordless: a single-use link by email. Nothing to reuse across sites, nothing to reset.
- Invite-only. Nobody can create an account; the church office adds a person.
- Whoever can read a person’s email inbox can sign in as them, so a member’s email account should be treated like a key — the same as it would be for any other passwordless service.
- The member portal is a web app installable to a phone home screen. There is no separate store app to keep patched.
Audit records
Logged actions
- Every check-in and collection action, including a release to someone not on a child’s authorised list — who collected, why, and in whose name.
- Deleting a person leaves a record of the deletion, so the history is not silently lost.
Logged exports
- Exports of the people directory, the giving ledger and an event’s sign-ups: who exported what, and when.
Known gaps
- Limit: the attendance export and the children’s-register export are not yet written to the audit log. Both remain office-only and role-gated; neither writes a log entry yet.
Exports and deletion
Available exports
- People, attendance, giving and the children’s register, all to CSV, from inside the app.
- Church administrators can export all four listed areas. Staff can export people, attendance and the children’s register, but not giving.
Member requests
- A member can download their personal data from their profile, including data not shown in the portal view.
- A deletion request starts a 30-day clock, visible to the office as a queue.
- A child’s record is never included in another member’s download.
If service ends
- Your church can end its account at any time and has at least 30 days to export its data. If ChapelHQ stops running, the terms commit to at least 90 days’ written notice and a complete export before anything is withdrawn.
Full detail on what is collected and why is in the privacy notice.
Operational safeguards
What is verified today, stated plainly, and what is not yet published rather than assumed:
- Backups are taken, per our terms of service — a specific schedule and recovery time are not yet published. Keep your own copy of anything your church cannot afford to lose.
- Support tools do not give ChapelHQ staff a church role that can browse records (see Access, above).
- Limit: a formal incident-reporting process is not yet published.
- Limit: no formal uptime service-level agreement is published. ChapelHQ is early-stage software, run by a small team, in pilot.
- Security contact: hello@chapelhq.com, read by the people who wrote the code.
Stated limits
- No barred-adult flag or watchlist — collection is checked against the authorised list and code, not against any automated alert.
- No payment processing of any kind.
- No third-party integrations.
- No SOC 2 or ISO certification.
- A team coordinator’s rota access is not yet narrowed to one team.
- Attendance and children’s-register exports are not yet written to the audit log.
Still not answered?
Send us your question. We’ll reply within three working days, including when a requested control is not available today.
Ask a security question