Security
Protecting ministry data is our top priority. Here's how we keep volunteer, roster, and Planning Center data safe.
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.3, the latest encryption standard.
Secure Infrastructure
Our infrastructure runs on a managed cloud platform, with encrypted data at rest and in transit.
OAuth 2.0 Authentication
We use Planning Center's secure OAuth 2.0 for authentication. We never store your Planning Center password.
What a signup sheet shows
A public signup sheet lists each scheduled volunteer by the full name Planning Center stores, and shows a photo when Planning Center has one.
Regular Updates
Our systems are continuously updated with the latest security patches and improvements.
Access Controls
Role-based access control ensures team members only see data appropriate for their permissions.
Our Security Practices
Data Protection
We implement multiple layers of security to protect your organization's data:
- Sign-in is Planning Center OAuth. We do not collect or store a Planning Center password
- Session tokens are cryptographically secure and expire automatically
- Database connections are encrypted and access is strictly controlled
- Regular automated backups ensure data can be recovered if needed
Personal data
- Public signup sheets show each volunteer's full name from Planning Center, and a photo when one is on file
- We do not sell personal data. We share it only with the service providers that run MinistryOps: our hosting provider, Planning Center, Stripe, Sentry, and Resend for email
- Data access is logged for audit
Planning Center Integration
Our integration with Planning Center uses their official OAuth 2.0 system:
- We never see or store your Planning Center password
- Access tokens are encrypted at rest
- You can revoke our access at any time from Planning Center
- We only request the minimum permissions needed for our features
Reporting Security Issues
If you discover a security vulnerability, please report it to us privately so we can address it before public disclosure. We appreciate responsible disclosure and will acknowledge your contribution.
Questions?
If you have questions about our security practices or need more information for your organization's compliance requirements, please contact us.