Security

• Hosting: the database is hosted in Australia by Supabase, on infrastructure with independent security certifications.
• Encryption: all traffic uses HTTPS. Data is encrypted at rest, and credentials for connected systems are encrypted again before storage.
• Separation: each church’s information is separated by row-level security in the database, and access follows each person’s role.
• Sign-in: people can sign in with a one-time email code instead of a password. Passwords are never stored in readable form.
• Accountability: privileged actions are recorded in an audit log, and staff access to production systems is limited to the few people who need it.
• Monitoring: errors are monitored continuously, with session replays that mask all text.
• Breaches: we will tell affected churches within 48 hours of becoming aware of a breach, as our data processing terms describe.

If you think you have found a security problem in Shep, please email security@shephub.com with the steps to reproduce it. We will acknowledge your report within 3 business days and keep you updated until it is fixed.

While you look, please:

• use only your own accounts or test accounts, and never access, change or keep other people’s information;
• stop and tell us as soon as you see information that is not yours;
• avoid anything that degrades the service, such as load testing or spam; and
• give us reasonable time to fix the problem before telling anyone else.

If you act in good faith and follow these guidelines, we will not take legal action against you, and we will gladly credit you if you would like.