Trust and security
The due-diligence packet.
Before a church trusts us with its members' data, a careful buyer asks for six things: the data processing terms, the companies that handle the data, what happens after a breach, what is logged, how long data is kept, and how it is encrypted. Every answer is on this page, so you do not have to email us for it. Where something is not in place yet, we say so.
Where we stand on SOC 2
FlockConnect holds no SOC 2 report. We do not claim certifications we do not hold.
The practices a SOC 2 report would describe are on this page: who handles your church's data, where it goes, how it is logged, how long it is kept, how it is encrypted, and what happens when you leave. This is our own account of them. No auditor has tested it, and that test is what a SOC 2 report would add.
We have set a specific recurring-revenue threshold at which we begin a SOC 2 Type II audit. We review that decision once a year and publish the result here.
Reviewed September 2026: not started. Next review September 2027.
Data processing terms
Your church owns its data. Our Terms of Service make your church the controller of its members' and pastoral data, and FlockConnect the processor that handles it on your church's instructions (section 3.2). For the data we need to run your account, such as billing and sign-in records, FlockConnect is the controller (section 3.3).
We do not have a standalone data processing agreement (DPA) yet. We are writing one, and it will be published on this page. Until then, the Terms of Service and the Privacy Policy are the agreement.
We have data processing agreements with the companies listed below. Those agreements are between FlockConnect and each company, and some of them are confidential, so we publish their status rather than the documents.
The companies that handle your church's data
These companies process data for FlockConnect. Each row says what the company does for us, what it can receive, where it processes data, and the status of our data processing agreement with it.
Supabase
- What it does for us
- Our database, sign-in, and file storage.
- What it can receive
- Everything your church keeps in FlockConnect, including care notes.
- Where
- United States (Northern Virginia)
- Data processing agreement
- Part of the terms we accepted
Vercel
- What it does for us
- Hosts the app and runs its server code. Also counts visits to our public website.
- What it can receive
- Every request to the app passes through it.
- Where
- United States (Washington, D.C. area)
- Data processing agreement
- Part of the terms we accepted
Anthropic and Google, through the Vercel AI Gateway
- What it does for us
- Help write Collie's drafts and answer Collie chat. Google runs the same Claude models only as a backup.
- What it can receive
- What a draft or a chat needs. Member names are replaced with neutral labels first, but your own words and a member's form answers still go. Nothing is kept or used for training.
- Where
- Routed by Vercel, no single-region commitment
- Data processing agreement
- Covered by Vercel's zero-retention agreements with both companies
AssemblyAI
- What it does for us
- Turns a care note spoken aloud into text (voice dictation).
- What it can receive
- The audio of what the person dictates, streamed from their browser. It never passes through our servers. We opted out of model training, so AssemblyAI does not keep the streaming audio or the transcript. The text comes back to the person's browser and becomes part of the note they save, like typed text.
- Where
- United States
- Data processing agreement
- Part of the terms we accepted
Stripe
- What it does for us
- Billing and subscriptions.
- What it can receive
- Billing contact and subscription details. Never pastoral notes or care content.
- Where
- Global, no single-region commitment
- Data processing agreement
- Part of the terms we accepted
Resend
- What it does for us
- Sends our email: sign-in codes and notices to your team, and form links and receipts to members.
- What it can receive
- The recipient's email address, the message, and whether it was delivered.
- Where
- Global, no single-region commitment
- Data processing agreement
- Part of the terms we accepted
Twilio
- What it does for us
- Sends limited text reminders for forms, with consent and opt-out respected.
- What it can receive
- A phone number, its consent state, the message, and whether it was delivered. Texts never carry care content.
- Where
- Global, no single-region commitment
- Data processing agreement
- Part of the terms we accepted
Google Maps Platform
- What it does for us
- Turns addresses into map locations and estimates drive times.
- What it can receive
- The street addresses your church records for people and places.
- Where
- Global, no single-region commitment
- Data processing agreement
- Part of the terms we accepted
Sentry
- What it does for us
- Error monitoring.
- What it can receive
- Technical error details with names, emails, notes, and AI prompts removed, plus opaque IDs.
- Where
- United States
- Data processing agreement
- Accepted, September 2026
PostHog
- What it does for us
- Product analytics.
- What it can receive
- Named product events and opaque IDs. Never member records.
- Where
- United States
- Data processing agreement
- Signed, September 2026
Cloudflare Turnstile
- What it does for us
- Checks that a person, not a bot, is filling in sign-up, sign-in, and public forms, such as a member's form or a booking page.
- What it can receive
- A one-time check token and the browser's connection details.
- Where
- Global, no single-region commitment
- Data processing agreement
- Part of the terms we accepted
Linear
- What it does for us
- Holds our support inbox.
- What it can receive
- Email you send to support@flockconnect.com. The app itself sends Linear nothing.
- Where
- United States
- Data processing agreement
- Part of the terms we accepted
Cal.com
- What it does for us
- Books demo calls from our public website.
- What it can receive
- The name, email, and notes a visitor enters to book a demo. Never church data.
- Where
- United States
- Data processing agreement
- Signed by both sides, September 2026
Reviewed October 2026.
Set up, but receiving nothing today
- ElevenLabs
- A former standby for voice dictation. It receives nothing today, and the code that could switch back to it is being removed.
- Mapbox
- A second map provider the code can use. It has no key in production, so it receives nothing.
- OpenRouter
- A backup route to AI models. It is switched off.
Not on this list, and why
- Planning Center, Google Calendar, and Microsoft Calendar
- Your church connects these with its own accounts, and FlockConnect acts on that permission. They are your church's providers, not ours.
- GitHub
- Holds our source code. Church data never goes there.
- YouTube
- Plays the videos on our public website. It receives nothing from the app.
If there is a breach
If we confirm that your church's data reached someone who should not have it, we tell your church without undue delay after confirming it, so your church can meet its own obligations. Our Terms of Service (section 12.3) and Privacy Policy (section 18) make that commitment.
We tell every account owner at your church, by email to the address they sign in with. We do not promise a fixed number of hours. We also notify individuals and authorities where the law requires it, including under North Carolina's Identity Theft Protection Act.
If you suspect someone has reached your church's data, tell us at support@flockconnect.com.
What we log, who can read it, and for how long
FlockConnect writes an audit record for many sensitive actions in your church's account, including: sending, accepting, or revoking an invitation; granting or removing a permission; issuing an emailed second-step code or checking one successfully, removing a second-step method, and registering or forgetting a trusted device; reviewing or approving a Collie draft or a form response, or changing who can see one; changing how sensitive a field is; merging two records; changing your church's connection health rules; turning Planning Center attendance write-back on or off; and downloading a data export. Each record says what happened and when, and usually which account did it. Some name no account, such as a record left by an automatic repair or by an account that has since been deleted. Records the app writes do not hold the IP address or browser of the person acting. Each Collie draft also records how it was produced, including the AI provider and model when one was used.
Some actions are not in this log. We do not log every time someone opens a record or reads a care note, and sign-ins are not recorded here.
Each person can see their own recent security activity in Settings, under Security. Within your church, only your account owner can read the full log. There is no screen for it yet, so an account owner who wants it asks us at support@flockconnect.com. Who at FlockConnect can reach your data, this log included, is on our trust and security page.
Our Terms of Service and Privacy Policy say audit and security logs are kept for up to 24 months. Nothing removes them automatically at 24 months yet, and today they outlast a deleted church account. We are building the removal, and this paragraph will change when it ships.
How long we keep data, and what happens when you leave
While your account is active, we keep your church's data. A few things are removed sooner: Ask Collie chats after 30 days, the product usage events we store after 365 days, and raw spreadsheet uploads 30 days after an import is approved or rejected (the records you approved stay).
Your account owner can download a full export at any time from Settings. Download links last 15 minutes, and the export file is deleted after 7 days.
If you cancel, your church has 90 days to export its data, and you can change your mind during that time. Then the data is deleted.
If a plan ends without anyone choosing to cancel, because a trial ran out with no plan started or payments failed, your account stays read-only and exportable for 12 months. Every account owner is emailed when that happens, again 30 days before deletion, and again 7 days before. Then the data is deleted the same way.
To delete everything sooner, your account owner chooses Close account and delete data in Settings. It asks for the second step and opens the same 90-day window, which you can cancel. After it, FlockConnect deletes your church's records and asks Planning Center and Google to revoke the access it held. If a revoke fails, deletion still goes ahead, and we follow up so that access can be removed. Microsoft offers no way for us to revoke access, so we delete the stored credential, and you can remove FlockConnect from your Microsoft account.
In every case, a legal hold, a billing dispute, or a legal obligation can pause or limit deletion, as our Terms of Service describe (section 13.4).
Some records remain after deletion: a record that the deletion happened, with counts but no content; the audit records described above, until the 24-month removal ships; billing records Stripe keeps under its own rules; delivery records at Resend and Twilio; and error reports at Sentry, which carry only opaque IDs, until its retention period ends.
Our database host takes a backup every day and keeps the last eight. Deleted data can remain in those backups for about eight days, until they roll off. A backup restores the whole service at once, so it is a last resort for disaster recovery.
Members do not have accounts, so a member's request to see, correct, or delete their information goes through your church, and we help your church answer it.
Encryption, precisely
In transit: every connection to FlockConnect uses HTTPS. Our host, Vercel, serves only TLS 1.2 and 1.3 and redirects plain HTTP to HTTPS, and our site tells browsers to use only HTTPS for the next two years. The app reaches our database over HTTPS as well, and Supabase's APIs accept only TLS 1.2 or 1.3. Voice dictation audio streams from the browser to AssemblyAI over an encrypted connection, using a single-use token.
At rest: Supabase, our database host, states that all customer data is encrypted at rest with AES-256. That protects the stored disks. It does not stop someone with access to the running database from reading it, which is why the access rules on our trust page matter.
On top of that, FlockConnect encrypts the credentials your church's connections use (Planning Center and the Google and Microsoft calendars) with AES-256-GCM before storing them. The key exists only on our servers, and a stored credential is useless without it.
What this does not cover: FlockConnect does not encrypt care notes or member records itself, beyond the database's encryption at rest. Our servers can read them, because they have to in order to show them to your team.
FlockConnect is not end-to-end encrypted. In an end-to-end encrypted system, only the people at each end hold the keys, and even the provider cannot read the content. That is not how FlockConnect works, and we do not describe it that way.
What we do not have yet
A due-diligence page that lists only strengths is a sales page. These are the gaps a reviewer would find, so we name them ourselves.
- A SOC 2 report. We review that decision every September; the next review is September 2027.
- An independent security audit or penetration test of FlockConnect.
- A standalone data processing agreement. We are writing it, and it will be published on this page.
- Automatic removal of audit records after 24 months. We are building it.
- A written incident response plan. How we handle security reports is written down; the steps for running an incident are not yet.
The binding documents
This page summarizes. The binding terms are in our Terms of Service and Privacy Policy. How the product keeps each church's data separate, and who at FlockConnect can see it, is on our trust and security page. Anything this page does not answer: support@flockconnect.com.
Care for your people without overexposing their data.
FlockConnect adds the relational layer on top of the church management system your church already runs. Starter is one flat price for any church or team size, with a 14-day trial and no credit card required.