Security overview

A church directory is personal information about real families. This page describes, plainly, how HomeField protects it. If you have a question this does not answer, write to us.

In transit and at rest

• TLS everywhere. Every connection to HomeField, including the marketing site, is encrypted. Plain HTTP is redirected.
• Encrypted storage. Database disks and object storage (photos, logos, backups) are encrypted at rest.
• US hosting. The service runs on DigitalOcean in the United States.

Accounts and sessions

• Passwords are hashed with bcrypt and are never stored or logged in clear text. Admins cannot see or set a member's password; invitations and resets happen on the member's own device.
• Password rules: at least 10 characters with upper, lower and a number.
• Sessions are httpOnly cookies that JavaScript cannot read. A session lasts until the browser closes (at most 8 hours), or 30 days when "Stay signed in" is ticked. Changing or resetting a password signs out every other device.
• CSRF protection on every request that changes something.
• Rate limiting and lockout on sign-in, password reset and similar endpoints, so passwords cannot be guessed by brute force.
• Google sign-in uses Google's verified ID token; we only ever learn the verified email address.

Keeping churches apart

Every church's data lives in the same system, so isolation is the thing we test hardest. Every record is scoped to its church, every query is filtered by it, and a request for another church's record returns "not found" rather than "forbidden", so nothing leaks by its shape. Automated cross-church isolation tests run in our continuous integration pipeline on every code change, and a failing test blocks the release.

Photos and files

Photos are served only to signed-in members of the same church, or to HomeField staff providing support. They are never on public URLs. Uploaded images are resized and re-encoded on the way in. A church's logo is the one public asset, because it appears on the sign-in page.

Audit log

Every change in a church is recorded with who, what, when, before, after and the IP address. Church admins can read their own log. Access by HomeField staff is recorded in the same log so churches can see it.

Backups

Daily backups, encrypted, kept in the same region. Restores are tested. After a church's data is deleted, backups containing it roll off within 30 days.

Staff access

HomeField staff have a separate operator sign-in that cannot be used to log into a church directory. Staff access a church's data only to support it, investigate abuse, or maintain the service, and that access is logged. Staff never change a member's email or reset a member's account on request; the church admin does, because they can verify identity in person.

If something goes wrong

If we confirm a breach affecting a church's data, we notify that church's admins by email within 72 hours, explain what we know, and keep them updated as we learn more.

Reporting a vulnerability

If you find a security problem, please email support@homefielddirectory.com with enough detail to reproduce it, and give us a reasonable time to fix it before publishing. We will acknowledge your report and tell you when it is resolved.