Security
A church hands us the names, phone numbers, email addresses and sometimes the prayer requests of people who visited once. This page describes the protections that exist today, in specific terms you can hold us to.
Every record — guests, conversations, tasks, knowledge — is owned by a single church, and every query the product runs is scoped to the church of the person making it. This is not a filter applied at the edge that could be forgotten in one place: it is applied at the data layer that every feature goes through. The AI is given only your church's own knowledge, so it cannot answer from another church's information, because it never receives it.
Every connection to SundayLoop is HTTPS, enforced by a strict-transport policy so a browser will not even attempt an unencrypted request. Passwords are stored as bcrypt hashes and are never recoverable — not by us, not by support. Sessions are httpOnly cookies, so no script on the page can read them.
Our providers call us back when a text is delivered, an email bounces, or a payment succeeds. Every one of those callbacks is cryptographically verified against the provider's signing secret, with a constant-time comparison, before a single byte of it is trusted. An unsigned or wrongly-signed request is rejected — it cannot mark a message delivered, change a subscription, or opt anyone out.
SundayLoop can read your church's public website to answer guests' questions. That feature is a URL you supply and we fetch, which is the classic way a product gets turned into a probe of its own private network. So it resolves the hostname, checks the resolved address is genuinely public, and then connects to that exact address rather than letting the HTTP client look it up again — the re-lookup is precisely how this defence is normally defeated. Redirects are re-checked the same way, and there is a size and time limit on what is read.
Every outbound message goes through one place, and that place checks the guest's per-channel permission immediately before sending — not when they were added, and not when the sequence was scheduled. A STOP reply stops every channel at once and cancels work already queued. A channel someone did not tick on your guest form is recorded as declined rather than left blank, so silence is never read as agreement.
Export every guest you hold as a CSV, at any time, from your own account. Delete an individual guest and their messages go with them. Close the account and your church's data is removed rather than retained indefinitely. None of this requires contacting us.
If you believe you have found a security problem in SundayLoop, please tell us before you tell anyone else, and give us a reasonable chance to fix it. We will not pursue anyone who reports a genuine issue in good faith and does not access, modify, or retain other people’s data while doing so.
Write to sundayloop.church@gmail.com.