Security your treasurer can take to the board.
Your congregation trusts you with their personal and payment information. We take that seriously — enterprise-grade controls are built in from day one, on every plan, for every church.
Your congregation trusts you with their personal and payment information. We take that seriously — enterprise-grade controls are built in from day one, on every plan, for every church.
TOTP-based MFA with recovery codes. Protect admin accounts with a second factor that works with any authenticator app.
Sign in with Google, Facebook, LinkedIn, or Apple. Reduce password fatigue while maintaining security standards.
Four system roles (platform admin, church admin, staff, giver) plus custom roles — give the bookkeeper read-only access, the deacons benevolence-only. Multiple roles per user.
Payment provider credentials and sensitive configuration are encrypted at rest using Fernet symmetric encryption. Keys are never stored alongside data.
Every gift, every profile change, every role assignment, every login — recorded in a hash-chained audit log where each entry is cryptographically linked to the one before it. The chain's integrity is re-verified every 6 hours, and the log is exportable — exactly what your board and your auditors want to see.
Every database query is scoped by organization ID. There is no API call that can access another organization's data — by design, not by convention.
All AI features run within the platform's tenant isolation boundary. Organization data is never shared across tenants, used for training external models, or accessible to other organizations. The AI intelligence layer operates on your data alone — with the same encryption, audit trail, and access controls as every other feature.
For multi-site and network setups, each branded platform is architecturally isolated — separate registration, separate sign-in scope, separate email identity. A giver on one site's platform cannot be discovered, contacted, or imported from another. More →
When a giver is deleted, their personally-identifying fields are stripped from every read path — the gifts they made stay in your ledger for compliance, but their name, email, and phone disappear from API responses. Right-to-erasure honored at the data-model layer, not just the UI.
Export-on-request, deletion-on-request, consent tracking, lawful-basis records. Built for European regulators by default, not as an afterthought toggle.
No card data ever touches AloraChurch's servers. Checkout runs in a hardened payment iframe — card numbers go directly from your giver's browser to the payment processor, and the page hosting the form architecturally cannot read or fake a gift. Your church inherits the processor's PCI compliance — not the other way around.
Givers sign in to My Giving with a one-time code sent to their email or phone — no passwords to create, forget, or leak. Your seniors can use it, and there's no password database for anyone to steal.
