Trust & securityCan we trust it with people and money?

The CovenantoryCommitment.

Responsible stewardship, protected information and a church that stays in control of its own data, built in rather than added on.

One person recordBy role

Built in, not bolted on

Eight commitments to every church.

Roles and permissions
Each role sees what it needs, by ministry and campus. Sensitive roles are granted separately.
Accountability built into the work
Important people and financial actions retain a history of activity, while financial corrections preserve their supporting record.
Care that respects confidentiality
Sensitive care information is available only to authorized people, with visibility appropriate to their responsibilities.
Two-step verification
A second sign-in step for sensitive roles, and a member app that locks to its owner.
Files checked before they are shared
Photos and documents are checked before anyone else can see them.
Messaging that respects consent
People choose what they receive, and opting out is honored right away.
Controls your treasurer will recognize
Two-person counts, review before posting, separate funds and bank reconciliation.
Your church's record stays yours
Your records belong to your church, and we never sell your data.

Found a security issue? Our security policy explains how to report it.

Your data

The record belongs to the church. These are the plain facts about who can reach it and how it leaves.

Access you grant, and can end
Deactivate an account and access ends; their work stays on the record, attributed.
Reports you can take with you
Download your finance and giving reports anytime, on every plan.
Never sold, never shared for marketing
We don't sell your data or use it to advertise to your members.
Support when you need it
Your team stays in charge of every approval.

Good questions

Straight answers from how Covenantory works today. Bring the rest to a walkthrough.

Who can see giving amounts?: Roles with finance permission. A care lead sees follow-up signals with amounts hidden, and a greeter sees check-in for today's service only.
What happens when a staff member leaves?: An administrator deactivates the account and access ends. Everything that person recorded stays on the record, attributed to them.
Are sensitive permissions handled differently?: Yes. Sensitive roles are granted separately from everyday access, and staff who hold them confirm sign-in with a second step.
Can we get our data out?: Finance and giving reports download on every plan. Before you subscribe, ask us which people, household and other exports are available, in what formats, and how to request the rest of your data.

See the role-aware views, the audit history and the two-person count with your own team in a guided walkthrough.