Updated September 13, 2026
A care record is a pastoral record. This page describes how Ministry Follow-Up keeps one church’s separate from every other church’s, what a volunteer can and cannot see, and what to do if you find a problem.
Every record in the database carries the church it belongs to, and the database refuses a read or a write that crosses that line. This is enforced in the database itself rather than in the application, so a mistake in a page cannot expose another church’s information: the query simply returns nothing.
Isolation is not a claim we re-check by hand. Our test suite asserts it on every change, along with the rest of the rules that must never regress: that a care team member sees only their own assignments, that a general administrator does not inherit access to confidential categories, and that care history cannot be rewritten. A change that breaks any of those does not ship.
A responder opens their assignment through a private link. They are not given an account, a password, or access to the church directory, and they cannot see any other care request, including other requests concerning the same person. The link is for one assignment. It expires, and reassigning the request stops the old one from working immediately.
Administrators, care leaders, and care team members see different things. A church decides which categories of care, and which forms, each role may reach. Confidential categories are not visible to a general administrator by virtue of the role alone.
What happened to a care request is append-only. Events can be added and nothing can be altered or removed afterwards, including by us. A record of care is only worth having if what it says today is what it said last year.
The application runs on Cloudflare. The database and the sign-in system are hosted by Supabase in its East US region. Both encrypt information at rest. Every connection is over TLS, and the site is served with HTTP Strict Transport Security, so a browser will not fall back to an unencrypted connection.
When a church connects Planning Center, its own mailbox, Square, or text messaging, the credentials it supplies are encrypted before they are stored and are never returned to a browser. A settings page shows only a hint, enough to recognise which value is in place. Card details are held by Stripe and never reach us. Our own service keys are held in the deployment secret store and are never written into the application bundle, which is checked automatically on every build.
Staff sign in with an email address and a password, and passwords are stored only as salted hashes. Reopening the platform always requires a sign-in. The one deliberate exception is a responder’s assignment link, which carries its own single-purpose token so a volunteer can answer from a phone without an account. That token grants access to one assignment and nothing else.
The platform refuses to be displayed inside another site’s frame, which is how a signed-in administrator gets tricked into clicking something they cannot see. The one exception is the blank embeddable form a church puts on its own website, which is deliberately framable and can only ever write into that church’s own queue. Responder pages are never cached by an intermediary, send no referrer, and are excluded from search engines.
The database provider takes its own backups. We additionally hold our own periodic copy outside that provider’s account, because a backup that lives in the same account as the thing it protects shares its single point of failure. We rehearse restoring from it.
We do not sell church or congregation information, we run no advertising on the platform, we set no third-party tracking cookies, and we do not use a church’s care records to train machine-learning models. We do not open a church’s care records except when that church asks us to help with a specific problem, or where we are compelled by law.
If you believe you have found a security problem, write to info@ministryfollowup.com with enough detail to reproduce it. We will acknowledge within two business days and tell you what we are doing about it. Please give us a reasonable opportunity to fix it before making it public, and please do not access, alter, or delete anybody’s records while investigating. We will not pursue anybody who reports a problem in good faith and in line with this paragraph.
Privacy Policy sets out what we collect and who handles it. Terms of Service is the agreement between your church and us.