Church records can include faith, family, health and giving. Here is how Kora OS is designed to protect them — with an honest view of what is built, what is still in progress and what we don’t claim.
Each church is a separate tenant. The active church comes from your verified membership — never from a value the browser sends.
The database enforces row-level security for tenant data, and the application connects with a restricted role that cannot bypass it.
Automated tests try to read and change another church’s data through the API and directly in the database, and expect to be refused.
Roles are granted at the church or at a specific campus. A campus grant does not reveal sibling campuses.
Nobody can delegate more access than they hold. Inviting staff and changing settings need multi-factor sign-in; changing roles and memberships needs a recent one.
Hiding a button is never the protection: every request is checked by the server.
Settings changes, invitations, role grants and denied access attempts are recorded with who, what and when — without copying personal content into the log.
Church administrators with audit permission can review recent activity in the workspace.
Prayer, counselling and welfare records will need explicit, case-level access. Owning a church workspace will not grant access to counselling notes.
Confidential items are designed to stay out of general search, previews, counts and notifications — and out of AI features by default.
Amounts are stored as exact minor units with an explicit currency. Giving, subscriptions and messaging credit are kept separate.
Payments are confirmed with the provider before a contribution or receipt is recorded. Card details are handled by the provider’s hosted checkout, not by Kora OS.
Sign-in uses an external identity provider; Kora OS never handles your password.
Sessions are server-side and revocable, end after inactivity, and you can sign out other devices yourself.
Kora OS is a pre-launch product. Automated tests are not the same as an independent assessment, and no software is attack-proof.
Kora OS does not hold SOC 2, ISO 27001 or any other certification.
Data-protection obligations depend on your country and are being assessed before pilot. We don’t claim legal compliance today.
An independent penetration test of tenant isolation, permissions and payments is a launch requirement, not yet completed.
Real records won’t be imported until security reporting, incident response and restore procedures are in place.
Please don’t open a public issue or include personal data in a report. A dedicated, monitored security contact will be published before pilot; until then, use the private vulnerability reporting route on the project’s code repository where enabled.