Security & Compliance Policy

Faith-Links treats administrator accounts as high-privilege and applies layered authentication controls to reduce the risk of unauthorized access.

• Platform-managed authentication. User identity, session management, password hashing, and token issuance are handled by the Base44 platform, which stores credentials using salted one-way hashes and enforces secure session tokens over HTTPS.
• MFA requirement for administrators. All users assigned the admin, pastor, or treasurer role are required to enable multi-factor authentication on their account through the platform's identity provider (e.g. Google Sign-In 2-Step Verification, or an authenticator app where supported). Administrators who have not enabled MFA will be prompted to do so and may have elevated privileges suspended until MFA is active.
• Least-privilege roles. Access is granted through defined roles (admin, pastor, elder, leader, deacon, treasurer, secretary, volunteer, user). Sensitive financial and member data is restricted to the minimum set of roles required to perform their duties.
• Session controls. Idle sessions are automatically logged out after a defined inactivity period, and users may manually sign out from their profile menu.

Faith-Links protects data in transit and at rest through platform-level encryption controls.

• Encryption in transit. All communication between end-user devices and Faith-Links is encrypted using TLS 1.2+ over HTTPS. HSTS is enforced on the published application domain.
• Encryption at rest. The underlying database and file storage provided by the Base44 platform encrypt stored data at rest using industry-standard AES-256 encryption.
• Credential storage. Passwords are never stored in plaintext; the platform's identity provider stores only salted, irreversibly-hashed credential representations.
• Secrets management. API keys, webhook signing secrets, and integration credentials are stored as platform-managed app secrets and are never exposed to client-side code or returned in API responses.

Data resilience and recovery are managed at the platform level to protect against data loss.

• Managed backups. The Base44 platform performs regular, automated backups of the application database and file storage. Backups are encrypted and retained according to the platform's backup retention schedule.
• Redundancy. Application infrastructure runs on managed cloud providers with regional redundancy and automatic failover for critical services.
• Recovery objectives. Faith-Links targets a Recovery Time Objective (RTO) of 24 hours and a Recovery Point Objective (RPO) of 24 hours for restored data, subject to platform capabilities.
• Church responsibility. Churches are encouraged to periodically export critical member and donation records to their own secure storage as an additional safeguard.

Faith-Links maintains an audit trail of significant actions performed within the application to support accountability and investigation.

• What is logged. Creation, update, and deletion of members, donations, events, departments, documents, and other core records generate an audit entry capturing the action, affected entity, the user who performed it, a timestamp, and (for updates) the old and new values.
• Access to logs. Audit logs are restricted to administrators and are viewable from the Audit Log page within the application.
• Integrity. Audit log entries are append-only from the application's perspective; only administrators may delete log entries, and such deletions are themselves recorded.
• Retention. Audit log entries are retained for a minimum of 12 months, after which they may be archived or purged in accordance with the retention schedule in Section 7.

A church or individual user may request termination of their account and deletion of their data at any time. The procedure is as follows:

• Submit a request. The account holder (or a church administrator on behalf of the organization) submits a termination request through the Account Termination page or by contacting legal@faith-links.com.
• Identity verification. Faith-Links verifies the identity and authority of the requester before processing. For church accounts, confirmation from a listed administrator is required.
• Data export. Upon request, Faith-Links provides a portable export of the church's member, donation, event, and document data prior to deletion.
• Deletion. Within 30 days of a verified request, Faith-Links deletes the church's data from production systems and requests deletion from platform backups as they expire. Pending legal-hold or legal-obligation data may be retained longer as described in Section 7.
• Confirmation. The requester receives written confirmation once deletion is complete.

Faith-Links maintains a documented incident response process for suspected or confirmed security breaches.

• Detection & assessment. Incidents may be identified through platform monitoring, automated alerts, or user reports. The response team assesses scope, severity, and affected data within 24 hours of discovery.
• Containment. Affected systems or credentials are isolated or rotated immediately to prevent further unauthorized access.
• Notification. Affected churches and users are notified without undue delay and in any case within 72 hours where a breach is likely to result in a risk to personal data, in accordance with applicable privacy laws (e.g. PIPEDA, GDPR). Notifications include the nature of the breach, data affected, and remediation steps.
• Eradication & recovery. Root cause is remediated, vulnerabilities patched, and systems restored from known-good state.
• Post-incident review. A written post-mortem is produced within 14 days, documenting timeline, cause, and preventive measures. Material incidents are recorded in the audit log.

Faith-Links retains data only as long as necessary for the purposes described in the Privacy Policy and to meet legal obligations.

• Active data. Member, donation, event, and document records are retained for the life of the church's subscription and until a termination request is processed.
• Financial records. Donation and transaction records are retained for a minimum of 7 years to satisfy tax and accounting obligations, even after account termination, after which they are securely deleted.
• Audit logs. Retained for a minimum of 12 months.
• Inactive accounts. Accounts with no activity for 24 months may be archived; associated data is deleted 6 months after archiving unless a legal hold applies.
• Deletion on request. On a verified termination or deletion request, personal data is removed from production within 30 days and from backups as backup cycles expire, except where retention is required by law.

Security and compliance are a shared responsibility between Faith-Links (the platform provider) and the church (the data controller).

Faith-Links is responsible for:

• Securing the application infrastructure, database, and file storage.
• Encryption in transit and at rest, and secrets management.
• Managed backups, redundancy, and platform-level disaster recovery.
• Authentication infrastructure, session handling, and MFA enablement.
• Providing audit logging, access controls (role-based permissions), and tools to manage user privileges.
• Breach detection at the platform level and breach notification.

The Church is responsible for:

• Classifying its data and determining which members and data are entered into the platform.
• Obtaining consent from its members before collecting or processing their personal data, and honoring withdrawal of consent.
• Assigning appropriate roles to its users and removing access promptly when staff or volunteers leave.
• Ensuring its administrators enable MFA and use strong, unique credentials.
• Responding to its members' data subject requests (access, correction, deletion) using the tools Faith-Links provides, or forwarding them to Faith-Links where platform action is required.
• Maintaining the accuracy of the data it enters and exporting critical records to its own storage as a secondary safeguard.

Where the church processes personal data on its own behalf, the church is the data controller and Faith-Links acts as a processor. The respective obligations are detailed in the Data Processing Agreement.

The following confirms the ownership of the assets that make up the Faith-Links service.

Domains

• Platform subdomain. The app.faith-links.com subdomain is provisioned and operated by the Base44 platform and is used to host the published application.
• Faith-Links domains. Faith-Links owns the faith-links.com domain and any marketing or support domains it connects to the service.
• Church custom domains. A church that connects its own custom domain retains full ownership of that domain and is responsible for its registration, renewal, and DNS configuration.

Source Code

• Application source code. The Faith-Links application source code, including pages, components, and configuration, is owned by Faith-Links.
• Platform framework. The Base44 runtime, SDK, build tooling, and platform-provided libraries are owned by Base44 and licensed to Faith-Links for use in operating the service.
• Church license. Churches receive a limited, revocable license to use the application as set out in the Terms of Service. They do not acquire any ownership interest in the source code. Churches may export their data at any time.

Hosting

• Application hosting, compute, content delivery, and runtime infrastructure are provided and operated by the Base44 platform on managed cloud infrastructure. Faith-Links does not own or operate physical servers or data centers; it configures and uses the platform's managed hosting to deliver the service.

Databases

• Database infrastructure. The database engine, storage, and backup infrastructure are owned and operated by the Base44 platform.
• Church data ownership. The church retains full ownership of all data it enters into the application — members, donations, events, documents, communications, and settings. The church is the data controller; Faith-Links and Base44 process that data on the church's behalf as described in the Data Processing Agreement.
• No co-mingling. Each church's data is logically separated by tenant identifier. Faith-Links does not sell, mine, or share church data with third parties for advertising.

The following matrix records who controls each critical asset that the service depends on. Assets marked Platform-managed are operated by the Base44 platform on Faith-Links' behalf. Assets marked Customer-controlled must be held and verified directly by the church or Faith-Links administrator.

Source-code repositories

Platform-managed. The application source code is maintained inside the Base44 platform workspace. Optional GitHub two-way sync (Builder plan or higher) mirrors the code to a repository the customer owns. Verify repository access in Dashboard → Code → GitHub sync if enabled.

Hosting accounts

Platform-managed. Application hosting, compute, and CDN are operated by the Base44 platform on managed cloud infrastructure. There is no separate cloud hosting account (AWS, GCP, Vercel) for the customer to control.

Production databases

Platform-managed (infrastructure); Customer-owned (data). The database engine and storage are operated by the Base44 platform. The church owns and may export its data at any time (Dashboard → Data → Export to CSV), but does not administer the database server.

Stripe / payment accounts

Customer-controlled. The connected Stripe account must be claimed by the customer (Dashboard → Integrations → Claim Account) and switched to live mode with the customer's own API keys before accepting real payments. Faith-Links does not hold custody of payment funds; Stripe pays out directly to the customer's bank account. The customer must verify Stripe account ownership, bank payout details, and webhook configuration.

Apple / Google developer accounts

Customer-controlled. Publishing native iOS and Android builds requires an Apple Developer Program account and a Google Play Console account held in the customer's name. Base44 does not hold these accounts. The customer must verify membership is active, the account is not shared with unrelated parties, and app record ownership belongs to the customer.

Analytics

Platform SDK + Customer-controlled (external). In-app event tracking uses the Base44 analytics SDK. Any external analytics provider (e.g., Google Analytics) is added by the customer via the app's index.html and uses the customer's own property IDs. Verify that external tracking IDs belong to the customer and that data sharing settings match the church's privacy policy.

Email service

Platform-managed (sending); Customer-controlled (domain). Outbound email is sent through the Base44 SendEmail integration. Reaching non-registered recipients requires a custom domain the customer connects and verifies. The customer must verify ownership of the sending domain and its DNS records (SPF, DKIM, DMARC).

APIs

Customer-controlled. Third-party API credentials (e.g., Google Meet OAuth, integration secrets) are stored as app secrets that the customer sets and rotates. Verify that each secret belongs to the customer's own account with the provider and that access is reviewed periodically.

DNS

Customer-controlled (custom domains); Platform-managed (subdomain). The app.faith-links.com subdomain is provisioned by the platform. Any custom domain's DNS is managed at the customer's domain registrar. The customer must verify registrar account access, domain renewal status, and that DNS records point to the intended destinations.

Backups

Platform-managed. Database backups and point-in-time recovery are operated by the Base44 platform. The customer is responsible for exporting critical data (CSV) for off-platform retention if required by the church's own continuity plan.

Verification responsibility

Faith-Links confirms the platform-managed assets above are operated by the Base44 platform. The customer is responsible for verifying direct control of every Customer-controlled asset by logging into each provider account and confirming ownership, active status, and authorized access. This verification should be repeated at least annually and whenever administrative staff change.