Where your data lives
- Church data is hosted in the EU, on Amazon Web Services in Stockholm.
- Error monitoring is hosted in the EU, and error reports leave out personal details such as email and IP addresses.
- Video rooms run on a video server we operate ourselves, on AWS in Stockholm.
- Some providers we rely on are based outside the UK and EU. Transfers to Stripe, Amazon Web Services and Sentry are covered by each provider's data processing agreement, which incorporates the UK Addendum to the EU Standard Contractual Clauses. The full list is in our privacy policy.
Each church's data is kept separate
Every church's records are tied to that church, and each request is checked against the church the person belongs to.
Encryption
- All traffic to the app and website uses HTTPS.
- The most sensitive stored values are encrypted with AES-256-GCM, including churches' bank details, SMS (Twilio) credentials, streaming keys, single sign-on secrets, two-factor secrets and pastoral care notes.
- The database and file storage are encrypted at rest.
- Card details never touch our servers; Stripe takes them.
Signing in
- Passwords are stored hashed (bcrypt), never in plain text.
- Two-step sign-in with a code sent by email is available to everyone, and church admins and managers always get one.
- On the Pro plan, churches can use single sign-on through their own identity provider (OIDC or SAML).
- Suspended accounts are blocked at sign-in and on every request.
Who can see what
- Each person has a church role, and can also hold functional roles such as finance, pastoral or safeguarding.
- Giving records are visible only to church admins and the finance and trustee roles. Pastoral care records are visible to admins, managers and the pastoral role. Safeguarding concerns are visible only to the church's safeguarding lead; admins stand in only if no lead is appointed.
- Department and group leaders manage their own teams without church-wide admin access.
Audit log
- Key admin actions are recorded, with who did what and when: role and permission changes, member imports and activations, payment-account changes, single sign-on and API key changes, safeguarding actions and children's check-in.
- The audit log is included on Starter and above.
- When a safeguarding lead opens a reported conversation, they must give a reason, and the access is logged before anything is shown.
Backups and recovery
The database is backed up automatically every day, and backups are kept for seven days in the same EU region (Stockholm). The database is protected against accidental deletion.
Payments
- Giving is processed by Stripe, and money goes straight to the church's own bank account through Stripe Connect.
- Payment and service notifications are signature-verified and processed only once.
Protecting the service
- Requests are rate-limited to slow down abuse.
- Errors are monitored so problems are spotted quickly.
Data protection
- The church is the data controller and Aurnet is the processor.
- Our Data Processing Agreement is at aurnet.co.uk/dpa.
- Aurnet Limited is registered with the ICO (ZC101797).
- Notification history is deleted after 90 days. When an account is deleted, personal data is deleted, except giving and Gift Aid records, which are kept for six years for HMRC, then deleted.
If something goes wrong
If we become aware of a breach affecting your church's data, we'll tell you without undue delay and help you meet your own reporting duties. To report a security concern, email legal@aurnet.co.uk.
Certifications
We don't currently hold a security certification such as Cyber Essentials, ISO 27001 or SOC 2. This page describes what we actually do, so you can judge it for yourself.