Member portal links are a bearer token
This is the unusual one, so it comes first. A member reaches their portal through a personal link. There is no password. Anyone holding that link can see what that member can see — their giving history, their groups, their family’s check-in records.
That is a real tradeoff and we chose it on purpose. The alternative is a password on every member of your congregation, and the honest outcome of that is a directory nobody reads: people do not create accounts for their church, they lose the password, and the features that depend on member participation quietly die. A portal your members actually open is worth more than one that is theoretically more secure and empty.
What we do to narrow it:
- Links are per person, never per household. Forwarding yours to your spouse gives them your view, not the family’s.
- Serving links are scoped and expire. A rota link is good for that shift and the following day, not indefinitely.
- Opening a link never performs an action. Nothing is confirmed, cancelled or paid for by visiting a URL.
- The phone app is different. It uses a phone number and a one-time code, so anything sensitive can live behind that instead.
- Links are stripped from logs. The identifier never appears in our logging, even in error traces.
If your church would rather not use portal links at all, they can be left switched off. Everything staff-facing works without them.
Staff accounts
Staff sign in with an email and password, not a link. Passwords are hashed, never stored or recoverable. Roles and per-permission grants control what each person can reach, and every church’s data is scoped separately at the database query — an administrator at one church cannot address another church’s records even by editing a URL.
What we store, and what we do not
- Card details: never. Giving runs through Stripe; card numbers do not reach our servers.
- Background check details: never. Dates of birth and Social Security numbers are entered on the screening provider’s own form. Neither your church nor Passport handles them.
- Face templates: only if you switch it on. Face check-in is off by default and cannot be enabled until a named administrator accepts responsibility for it in writing. Templates are mathematical, not photographs, are deleted when a person is removed or asks, and are purged automatically for anyone who has not attended within a window you set.
- Integration credentials are encrypted at rest with AES-256-GCM, and the system refuses to start rather than run without the key.
Getting your data out
Your records are yours. Export people, giving and attendance as CSV whenever you want, without asking us. If you leave, you leave with your data — there is no retention hold and no export fee.
Reporting something
If you find a vulnerability, tell us at [email protected]. We will acknowledge within one working day. We will not threaten anybody who reports a problem in good faith.