How do member portal links work?
A member portal link is a bearer token. This is the unusual one, so it comes first. A member reaches their portal through a personal link, and there is no password. Anyone holding that link can see what that member can see: their giving history, their groups, their family’s check-in records.
Why we chose it
It’s a real tradeoff and we made it on purpose. The alternative is a password for every member of your congregation, and the honest outcome of that is a directory nobody reads. People don’t create accounts for their church, they lose the password, and the features that depend on member participation quietly die. A portal your members actually open is worth more than one that is theoretically more secure and empty.
What we do to narrow it
- Links are per person, never per household. Forwarding yours to your spouse gives them your view, not the family’s.
- Serving links are scoped and expire. A rota link is good for that shift and the following day, not indefinitely.
- Opening a link never performs an action. Nothing is confirmed, cancelled or paid for by visiting a URL.
- The phone app is different. It uses a phone number and a one-time code, so anything sensitive can live behind that instead.
- Links are stripped from logs. The identifier never appears in our logging, even in error traces.
Your choice
If your church would rather not use portal links at all, leave them switched off. Everything staff-facing works without them.
How do staff accounts and permissions work?
Staff sign in with an email and password, never a link. Passwords are hashed, so they are never stored or recoverable. Roles and per-permission grants control what each person can reach.
Every church’s data is scoped separately at the database query. An administrator at one church cannot address another church’s records, even by editing a URL.
What does Passport store, and what does it never store?
- Card details Never
- Giving runs through Stripe. Card numbers do not reach our servers.
- Face templates Only if you switch it on
- Face check-in is off by default and cannot be enabled until a named administrator accepts responsibility for it in writing. Templates are mathematical, not photographs. They are deleted when a person is removed or asks, and purged automatically for anyone who has not attended within a window you set.
- Integration credentials Encrypted at rest
- Credentials for connected systems are encrypted at rest with AES-256-GCM, and the system refuses to start rather than run without the key.
Can we get our data out of Passport?
Your records are yours. Export people, giving and attendance as CSV whenever you want, without asking us. If you leave, you leave with your data. There is no retention hold and no export fee.
How we collect and use personal information is set out in the privacy policy, and the terms of your subscription are in the terms and conditions.
How do I report a security problem?
If you find a vulnerability, tell us at [email protected]. We will acknowledge it within one working day. We will not threaten anybody who reports a problem in good faith.
Security questions churches ask
No. A member reaches their portal through a personal link, and anyone holding that link can see what that member can see. Links are per person, serving links expire, opening a link never performs an action, and links are stripped from logs. A church can leave portal links switched off, and the phone app signs in with a phone number and a one-time code.
No. Giving runs through Stripe, and card numbers never reach Passport’s servers.
No. AI attendance is part of Pro and starts switched off. It cannot be enabled until a named administrator accepts responsibility for it in writing. Face templates are mathematical, not photographs, are deleted when a person is removed or asks, and are purged automatically for anyone who has not attended within a window your church sets.
Yes. Export people, giving and attendance as CSV whenever you want, without asking us. If you leave, you leave with your data: there is no retention hold and no export fee.
Email [email protected]. We acknowledge reports within one working day, and we will not threaten anybody who reports a problem in good faith.
