Church software
Church management software: where the sensitive records live
Your church management system (ChMS) holds the most sensitive things your church knows: addresses, family details, children's names, giving history, pastoral notes. A breach here matters far more than a defaced website. Most of the protection depends on how your church sets it up.
How to read the vendor notes below.
These summarize what each vendor publishes in its own help pages, checked 21 October 2026. "Not documented" means we didn't find it on a page we opened, not that the feature doesn't exist. We don't rank vendors, and pages change, so confirm anything important with your vendor. We have not tested any of this software.
What your church controls, whichever software you use
- Turn on two-step sign-in for every account that has it, and require it where the software lets you.
- One person, one login. No shared "office" account.
- Least access. Giving records, children's information and pastoral notes should reach only the few people who need them. Volunteers who run check-in shouldn't see giving.
- Remove people the day they leave (checklist).
- Be careful with exports. A downloaded directory or giving report is now an unprotected file, on a laptop or in an email. Export only what's needed, and delete it afterward.
- If any of it is installed on a church computer, that computer is part of your security: keep it updated, back it up somewhere else, lock the office, and use a separate login for each person.
Cloud or installed on your own computer?
Cloud-hosted software runs on the vendor's servers; they patch and protect them, and flaws like this month's PHP problem are theirs to handle. Installed software runs on your own computer or server, so patching, backups and physical security are yours. Neither is automatically safer, but you should know which you have.
What each vendor publishes
Realm (ACS Technologies)
- Where it runs
- Cloud. ACS says it partners with hosting providers including Amazon Web Services (ACS trust center FAQ).
- Two-step sign-in
- Available, and an administrator can require it for all users, for designated users, or for individuals. Users are prompted at each sign-in, or every 90 days if they stay signed in (Realm help).
- Who sees what
- Access is set by "responsibilities." A Limited Access Administrator responsibility excludes giving, and giving permissions are separate (view summary, view individual contributions, enter, post) (Realm permissions list). A check-in-only role isn't documented on the page we read.
- Audit trail
- A Change Log, visible to administrators, records changes to people, contributions, check-in, groups and security settings. Entries are kept 120 days (365 for privacy-related changes), so export it periodically if you want a longer record. Logging of who merely viewed a record isn't documented (Realm help).
- Leaving
- ACS says it stores your data in an encrypted location for six months after cancellation before deleting it, and that some products need an offboarding call to learn what to download (ACS).
- More
- Trust center · Status page
Planning Center
- Where it runs
- Cloud. "All of your data is stored in AWS data centers," encrypted in transit and at rest. Planning Center lists SOC 2 Type 2 and a bug-bounty program (security page).
- Two-step sign-in
- Available to every user. An administrator can require it for organization administrators and billing managers. Requiring it for all users isn't documented on the page we read (Planning Center help). Encourage everyone else to turn it on themselves.
- Who sees what
- Permissions are set separately in each product. Giving has its own levels (Administrator, Bookkeeper, Counter, Reviewer), and Planning Center says organization administrators have full administrator access to all products except Giving (Giving permissions, account settings). Taking attendance at a Check-Ins station doesn't need Check-Ins access (Check-Ins permissions).
- Audit trail
- A Security History tab, for organization administrators, logs sign-ins, password and login-method changes, permission changes and exports, with user, IP address and time. Logging of record views isn't documented (Planning Center help).
- Leaving
- After cancelling, data is stored for one year and then permanently deleted. Giving reports export as CSV (cancelling, exporting giving).
- More
- Security page · Status page
Shelby Systems
- Which product
- The current products are ShelbyNext Membership, Financials and Giving. Shelby v5, the older version, reached end of maintenance on 31 March 2020, and the vendor says the software "will not be disabled" (Shelby blog). Software that is no longer maintained stops getting security fixes, so a church still on v5 should plan a move.
- Where it runs
- Shelby describes ShelbyNext as cloud-based (Shelby). Whether self-hosting is still offered isn't clear from the pages we read; ask.
- Two-step sign-in
- ShelbyNext Financials supports multi-factor sign-in by text message (Shelby help). For Membership, and whether an administrator can require it, we found nothing documented; ask.
- Who sees what
- Security Setup has users, task roles and account-rights roles; in Financials, account-rights roles limit which accounts a user can reach (Shelby help). How Membership separates giving from directory data isn't documented on pages we read.
- Audit trail
- Not documented on the pages we read; ask.
- Leaving
- ShelbyNext Giving data can be downloaded as CSV (Shelby FAQ). Other export and post-cancellation handling aren't documented; ask.
- More
- We found no dedicated security or status page. Support
PowerChurch
- Where it runs
- PowerChurch Plus is desktop software installed on the church's own computer. PowerChurch Online is "an installation of PowerChurch Plus which resides on our servers" (PowerChurch). So with Plus, protecting the computer is your job; with Online, the vendor hosts it.
- Two-step sign-in
- Not documented on the pages we read, for either product; ask. Both support individual user accounts, but on Online all staff share one logon by default until you set up separate ones (PowerChurch Online). Set them up.
- Who sees what
- Plus lets you "grant Access, Add/Change, and Delete permissions for each user for each module" (PowerChurch Plus).
- Audit trail
- Plus keeps audit logs of important activity, such as posting transactions or restoring a backup, with date, time and user (PowerChurch Plus). Logging of views or exports, and whether Online has the same log, isn't documented.
- Leaving
- On Online you can export your database to an Access file before cancelling, and the vendor keeps archived data for one year after disconnection (PowerChurch Online FAQ). Online data is backed up offsite every 30 minutes, but you won't have access to those backups, so use the built-in backup yourself.
- More
- We found no dedicated security or status page. Confidentiality statement
For all four, we searched for public breach or security-incident notices from the past five years and found none. That was a web search, not a check of state attorney-general breach databases, so "none found" is not "none exist."
Questions to ask your vendor
- Can we require two-step sign-in for every user? If not, for which users?
- Can we limit a volunteer to check-in only, with no access to giving or the directory?
- Can an administrator see who viewed or exported member records, and for how long is that kept?
- Where is our data stored, and how is it backed up and encrypted?
- If you have a security incident affecting our data, how and when will you tell us?
- If we leave, how do we get all our data out, in what format, and how long do you keep it?
- (If installed on our computer) How are updates delivered, and which versions still get security fixes?
Sources
Linked inline above, from each vendor's own documentation. Checked 21 October 2026.