Trust and security
Built for sensitive pastoral data.
FlockConnect is designed around church-scoped access, role-based visibility, human approval, privacy-aware AI, and careful service integrations, so pastors can act on relationship needs without exposing more data than necessary.
Church-scoped data
Every church's data is scoped to that church. The boundary is enforced in the database with row-level security and checked again on the server with every request, so each church's records stay within that church.
Roles and visibility
Account owners, church leaders, and care partners have different levels of access. A care partner only sees the people assigned to them, not the whole congregation. Members never log in at all, so the people a church serves are not asked to manage an account.
A fresh check before sensitive actions
Signing in stays simple, and the actions that could expose data ask for more. Inviting a teammate, exporting data, changing billing, or connecting Planning Center first asks the person to verify with a one-time code or an authenticator app, right where they are. One verification holds for a day, and each person can review their own recent security activity, where actions like invitations and data exports stay on the record.
A person approves every draft
Collie can draft a note, suggest a next step, or show how a person you are looking at is doing. Some drafts, like the weekly brief, are prepared on a schedule, but nothing Collie drafts reaches a member or a connected system, and no care record is created, until a person approves it.
Privacy-aware AI
AI context is permission-aware, redacted where required, and source-tracked. Member names are replaced with neutral labels before context goes to the AI, with known gaps that our Collie ethics page names one by one, and the provider, model, and provenance of each result are recorded, so a pastor can see where a suggestion came from. The account owner can switch Collie off for the whole church, and anyone can hide it for themselves. Collie is not part of the Starter plan. Voice dictation is a separate service and is not turned off by the Collie switch.
Encrypted integration credentials
Connections to services like Planning Center use OAuth. The tokens are encrypted at rest and are never exposed to browser JavaScript. Disconnecting a service deletes the stored credential, so FlockConnect can no longer use it. Planning Center is also asked to revoke it; for Google or Microsoft, you can also remove FlockConnect from your own account.
Telemetry with PII controls
Error monitoring and product analytics are scrubbed. Names, emails, church names, pastoral notes, and AI prompts are kept out of error reports. Analytics use explicit events and surrogate IDs rather than raw member data, and sensitive screens are masked.
Safer communication and calendar defaults
Member assessments are sent by email first. SMS is only a limited fallback after an assessment goes uncompleted, with consent and opt-out respected, and it never carries sensitive care content. Calendar events use generic text and secure links, so pastoral details do not travel in a calendar invite.
Evidence before claims
Every claim on this page is held to an evidence bar before it ships: automated tests, browser checks for each role, and provider configuration review. Where something cannot yet be proven, it stays a design intention rather than a public promise.
What leaves FlockConnect, and what does not
FlockConnect uses a small set of trusted providers to do its job. Here is what each one receives, at a high level. A church on Planning Center connects through the official two-way Planning Center integration.
- Supabase
- Stores FlockConnect's app data in church-scoped records protected by row-level security and server authorization.
- Stripe
- Receives billing and subscription data. It does not receive pastoral notes or care content.
- Planning Center
- Receives reviewed writebacks only after a person approves them. Pastoral notes and AI summaries are not written back by default.
- Resend
- Sends transactional email and secure assessment links using safe template variables.
- Twilio
- Sends limited SMS assessment reminders, only after an email goes uncompleted, with consent and opt-out checks.
- Google and Microsoft Calendar
- Receive generic event details and secure links, not sensitive pastoral details.
- Google Maps
- Used through server-side adapters for routing and proximity, under approved storage rules.
- AI providers (Anthropic and Google, through the Vercel AI Gateway)
- Receive only what a draft or a chat needs. Member names are replaced with neutral labels first, but your own words and a member's form answers still go, and they can hold sensitive details (the Collie ethics page lists exactly what). Nothing is kept or used for training. Google runs the same Claude models only as a backup. The provider, model, and provenance are tracked.
- AssemblyAI (voice dictation)
- When you dictate a care note, your voice goes straight from your browser to AssemblyAI, which turns it into text. It hears what you say, names included. It keeps neither the recording nor the text and does not train on them, and the note is saved only when you save it. You can always type instead.
- Sentry
- Receives scrubbed technical error context, release metadata, and surrogate IDs.
- PostHog
- Receives explicit, privacy-reviewed product events and surrogate IDs.
- Linear
- Holds our support inbox: email you send to support@flockconnect.com. The app itself sends it nothing.
Where we stand on SOC 2
FlockConnect holds no SOC 2 report. We do not claim certifications we do not hold.
The practices a SOC 2 report would describe are set out in our due-diligence packet: the companies that handle your church's data and where, breach notice, what we log, how long we keep data, how it is encrypted, and what is not in place yet. It is our own account, and no auditor has tested it.
We have set a specific recurring-revenue threshold at which we begin a SOC 2 Type II audit. We review that decision once a year and publish the result here.
Reviewed September 2026: not started. Next review September 2027.
Who at FlockConnect can see your data
FlockConnect is built and run by a small team, so this question deserves a straight answer: what can the people who run the service see?
Day-to-day operations do not involve reading your church's records. The internal console we run the business from works through a small set of narrowly-scoped, purpose-built functions: signups, adoption and revenue summaries, provider costs, and trust-and-safety actions such as suspending an abusive account. It has no screen that lists your members and no function that opens a care note.
We will be honest rather than absolute: the people who operate a service's database can, in the end, reach the data in it, and a promise that we never could would be marketing rather than architecture. What we can tell you is how the everyday paths are built, and what we commit to in practice: pastoral notes are not part of routine operations, support works from what you show and tell us, and if resolving a problem ever required looking into your church's data, our commitment is to ask you first.
Shared responsibility
We do our best to protect the data churches trust us with, using the measures described above. At the same time, we will be honest: security is never absolute, and no tool can remove every risk. FlockConnect is provided as is, under our Terms of Service.
You have a part too. You decide who to invite, what access to grant them, and what to record. Keeping your own login credentials safe, and using FlockConnect responsibly with the people in your care, is up to you. If anything here raises a question about how your church's data is handled, please reach out and ask.
For the binding details, read our Privacy Policy and Terms of Service. Questions about how your church's data is handled? Email support@flockconnect.com.
Writing about FlockConnect? The press and media kit has the facts, the logo files, and our prior coverage.
What the connection reading is, who can see it, and what Collie never does with it is on the Collie ethics page.
Report a security problem
If you think you've found a security problem in FlockConnect, email security@flockconnect.com. Our vulnerability disclosure policy says what to include, where you may test, what we promise in return, and how safe harbor protects you.
If you think someone has signed in as you, or reached your church's data without permission, write to the same address.
Care for your people without overexposing their data.
FlockConnect adds the relational layer on top of the church management system your church already runs. Starter is one flat price for any church or team size, with a 14-day trial and no credit card required.