Security

Security and privacy commitment

Church teams trust Cendance with operational data about people, households, volunteers, donors, media, and finance workflows. Our security work is focused on protecting that data while keeping daily ministry operations clear and usable.

GDPR support

Cendance is designed to help organizations handle personal data with clear ownership, privacy-aware workflows, and support for data rights conversations.

Data protection

Cendance combines application-level controls and managed infrastructure practices to reduce unnecessary exposure of sensitive organization data.

• Data at rest: customer data is stored in managed infrastructure designed around encryption-backed storage controls
• Data in transit: browser and application traffic is protected with HTTPS/TLS
• Data boundaries: workspaces are scoped by organization to keep records separated
• Data stewardship: privacy and retention expectations are reviewed as the platform evolves

Account and sign-in security

Every account gets modern sign-in protection, and people are asked to reconfirm their identity before the most sensitive changes.

• Secure sign-in: protect an account with an authenticator app or a passkey, backed by single-use recovery codes
• Organization requirement: administrators can require everyone in their workspace to set up secure sign-in
• Step-up checks: changing a password or sign-in email, updating payout details, or granting admin access asks the person to confirm it is them
• Trust this device: people can trust a device for 30 days to reduce repeat prompts, while the most sensitive actions always ask again
• Brute-force protection: repeated failed sign-in attempts progressively lock the account

SOC 2 audit

Cendance is currently undergoing a SOC 2 audit and is working toward full compliance soon. Security review, evidence collection, access controls, and operational practices are part of that audit preparation.

Security controls

Our security controls are organized around the systems, people, and product workflows that support customer data.

• Infrastructure security: production access, environment boundaries, and managed service controls
• Organizational security: internal access expectations and operational review practices
• Product security: two-factor secure sign-in, step-up checks on sensitive actions, permission-aware surfaces, and organization-scoped workflows
• Data and privacy: personal data handling, access review, and sensitive workflow review

Responsible disclosure

If you believe you have found a vulnerability or security issue in Cendance, please contact us with enough detail to reproduce and assess the report.

Frequently asked questions

Security reviews often need direct answers about encryption, access, compliance status, and subprocessors. Contact us if your procurement or security team needs current materials.

• Is customer data encrypted? Cendance uses managed infrastructure designed around encrypted storage and HTTPS/TLS traffic
• Does Cendance support two-factor authentication? Yes. Accounts can use an authenticator app or a passkey with recovery codes, organizations can require it for everyone, and sensitive actions ask people to reconfirm their identity
• Is Cendance SOC 2 compliant? Cendance is undergoing a SOC 2 audit and working toward full compliance soon
• Does Cendance support GDPR conversations? Yes, Cendance provides GDPR-oriented resources and privacy request support paths
• Where can I find subprocessors or data processing terms? The subprocessor list and the Data Processing Agreement are published on the legal pages, and every published version stays permanently available