Security

Security and privacy commitment

Church teams trust Cendance with operational data about people, households, volunteers, donors, media, and finance workflows. Our security work is focused on protecting that data while keeping daily ministry operations clear and usable.

GDPR support

Cendance is designed to help organizations handle personal data with clear ownership, privacy-aware workflows, and support for data rights conversations.

Data protection

Cendance combines application-level controls and managed infrastructure practices to reduce unnecessary exposure of sensitive organization data.

• Data at rest: customer data is stored in managed infrastructure designed around encryption-backed storage controls
• Data in transit: browser and application traffic is protected with HTTPS/TLS
• Data boundaries: workspaces are scoped by organization to keep records separated
• Data stewardship: privacy and retention expectations are reviewed as the platform evolves

SOC 2 audit

Cendance is currently undergoing a SOC 2 audit and is working toward full compliance soon. Security review, evidence collection, access controls, and operational practices are part of that audit preparation.

Security controls

Our security controls are organized around the systems, people, and product workflows that support customer data.

• Infrastructure security: production access, environment boundaries, and managed service controls
• Organizational security: internal access expectations and operational review practices
• Product security: authenticated access, permission-aware surfaces, and organization-scoped workflows
• Data and privacy: personal data handling, access review, and sensitive workflow review

Responsible disclosure

If you believe you have found a vulnerability or security issue in Cendance, please contact us with enough detail to reproduce and assess the report.

Frequently asked questions

Security reviews often need direct answers about encryption, access, compliance status, and subprocessors. Contact us if your procurement or security team needs current materials.

• Is customer data encrypted? Cendance uses managed infrastructure designed around encrypted storage and HTTPS/TLS traffic
• Is Cendance SOC 2 compliant? Cendance is undergoing a SOC 2 audit and working toward full compliance soon
• Does Cendance support GDPR conversations? Yes, Cendance provides GDPR-oriented resources and privacy request support paths
• Where can I ask about subprocessors or questionnaires? Email us or use the contact form for current security materials