How your church's data is kept

Last updated: October 2026, after that month's outside test.

Church Engagement OS is run by The Barrett Group LLC, a small company. This page is written for a treasurer, a council member or a pastor deciding whether to trust us with a congregation's records. It says what we do, what we do not do, and what we have not built yet. We would rather you read a short true page than a long reassuring one.

Your data is only yours

Every church's records are sealed off from every other church's at the storage level. The database itself refuses to hand one church's rows to another church's session; the software is not relied on to remember to filter. An outside tester tried to cross that wall in September and again in October 2026 and could not.

Care and money are kept apart

Access is granted per module and per person: People, Events, Communication, Serving, Giving, Care, Counting and the finance-committee view, each as read or read-and-write. A new staff member starts without Giving. A volunteer counter sees the counting table and nothing else. The finance committee sees totals without names. Pastoral care records are visible only to the people carrying each case, and the follow-up queue never shows an amount.

Signing in

Staff and members sign in with a link sent to their email, or with Google. There is no second password to lose.
A signed-in session ends after a period of inactivity, the way a bank's does.
Sensitive actions ask the person to confirm it is still them before they go through.
Not yet built: two-step sign-in with a code from a phone or an app. Today, whoever controls a staff member's email inbox can get into their account. We say so here rather than imply otherwise, and it is the next security item on our list.

Tested by an outsider every month

Each month we pay for a penetration test: a tool given permission to attack a private copy of the system loaded with made-up churches and people, carrying each attack through to prove it is real. We publish what it found.

September 2026. Four real problems, every one fixed within hours and live the same day: a member could relabel their own record to receive a staff member's view; a session stayed valid too long on an unattended machine; one staff search box could be made to return the whole roster; one address filter could be fooled by an unusual spelling. The wall between churches held in every test.
October 2026. No new way in. The test repeated its one standing point, the missing second sign-in step, which is recorded above.
Left open on purpose. The sign-in page says whether an address is on file, because that honesty helps real people who mistype. We chose helpfulness over secrecy and know the trade.

Money

Gifts settle in the church's own Stripe or PayPal account. The church is the merchant. Money never passes through us and we never hold funds.
Card and bank details stay with the processor. We see the gift record: who, how much, which fund, when, and the processor's payout figures.
A giving forward from Venmo, PayPal, Vanco or Thrivent is read for the gift it announces and then kept as the record of that reading.

No AI in the application

Nothing in the product uses artificial intelligence. No model reads your records, drafts your messages, scores your people, or decides anything about anyone. Every rule the system applies is written down in plain code and can be read.
The application sends no church data to any AI service, and no church's data is used to train anything.
We do use AI tools when writing the software itself, the way we use an editor. They work on the code and on made-up test data. A church's real records are looked at by a person only when that church asks us to.

Children

The record holds a birthdate, so the system knows who is a child and keeps minors out of audiences meant for adults.
We do not hold medical notes, allergy lists, guardian or pick-up permissions, or background-check records. If your children's ministry needs those, use a dedicated children's check-in product alongside this one, and do not put them in a custom field here, where anyone with People access could read them.

Leaving, and the question behind it

The question behind "what if your company disappears" is "can we get our data out, today, without asking." Yes.

An administrator can download everything the church has here as one file, at any time, from the privacy page while signed in: people, households, giving, deposits, events, groups, imports, settings and staff, whole rows with their ids, so it can be loaded somewhere else rather than only read.
Every report also downloads as CSV or Excel.
The same page lets an administrator erase the church. Archiving a church and restoring it later is done on request.

Where things run

The application runs on Vercel. The database is Postgres, hosted by Supabase in Amazon's us-east-1 region in the United States.
Online giving runs through Stripe and PayPal. Email is delivered through Resend, and texts through Telnyx. Google provides sign-in and the Google Sheets connection.
Church email carries no per-person open-tracking pixel. That is a decision, not an omission.
We do not hold a SOC 2 report or a comparable certification. We are a small company, and this page is what we can honestly show instead.

Telling us about a problem

Write to hello@engagement.church. We read it the same day, and a real problem is fixed before anything else is worked on.

See also the Privacy Policy and the Terms of Service.