Card data never touches our servers
Online giving and event payments use Stripe Checkout, hosted by Stripe. Card numbers are entered on Stripe's pages and stored by Stripe. Steeple only ever sees a token and the outcome.
Security
What we do, and what we don't have yet.
Churches trust us with donor records and children's check-in data. This page is the honest version of how we protect it, written so a non-technical board member can read it.
Encryption in transit
Every connection to Steeple, and from Steeple to Stripe, Twilio, Resend and our database, uses TLS. We do not serve anything over plain HTTP.
Per-church isolation
Every record carries the church it belongs to, and every query is filtered by the signed-in user's church. A church identifier from a request body is never trusted.
Role-based access
Owner, admin, staff, leader, volunteer and member roles, plus module-level permissions such as giving.view. Memberships are re-checked on every request, so removing someone takes effect immediately.
Audit log
Meaningful changes, from a role change to a data export, are written to an audit log with who, what and when. Admins can review it in Settings.
Daily backups with off-site copies
The database is backed up daily and copies are stored off the primary host. We practice restores so a backup is more than a hope.
MFA on infrastructure
Access to hosting, the database, DNS and the provider accounts we depend on requires multi-factor authentication and is limited to the people who operate the service.
Data export any time
Owners and admins can export the entire workspace as JSON from Settings, and every directory and report exports to CSV. No ticket, no waiting period.
What we do not have yet
- No SOC 2 report. We have not completed a SOC 2 audit. It is on the roadmap, and we will link the report here when it exists. Until then, this page and our contracts are what we can offer.
- No customer-managed encryption keys. Data at rest is protected by our hosting provider's disk encryption, not by keys you hold.
- No self-hosted option. Steeple runs only as our hosted service today.
- No two-factor login for church users yet. Staff accounts use email and password with rate-limited sign-in. Two-factor authentication for user logins is planned.
Subprocessors
Who else touches your data.
We use a small number of providers, each for one job. Their role is spelled out in our data processing addendum.
- StripePayments and payouts on your own connected account
- TwilioSending and receiving text messages
- ResendSending email and reporting delivery
- AnthropicOptional AI drafting of sermon slides and messages; only when you use it
- Hosting providerApplication servers, database and backups
Full details in the data processing addendum.
Reporting a vulnerability
If you believe you have found a security issue in Steeple, email [email protected] with the steps to reproduce it. We acknowledge reports within two business days, keep you informed while we fix the issue, and credit you if you would like. Please do not access data that is not yours and do not run automated scanners against production.
Questions about security?
Send us your security questionnaire or just ask. We answer in plain English and we will tell you when the answer is no.