People's data
People's data and who has access
A church holds things people tell it in trust: addresses, phone numbers, children's names, what they give, what they're praying about. Protecting that is a pastoral duty before it's a technical one.
Documents on your website
Churches often upload a directory, a prayer list or board minutes as a PDF. If the page is public, search engines can find and keep the file, even after you take it down. We haven't measured how often this happens, and we are not reporting it as a finding. The risk is real enough to check.
- Search your own site. In a search engine, type site:yourchurch.org directory, then try prayer, roster, minutes and giving. Look at what comes up as a stranger would.
- If a file names people, shows addresses or phone numbers, or lists what people give, take it off the public site and put it behind a login (your church software can usually do this).
- Prayer lists that name people and their conditions: get permission, or use first names and general terms ("a member recovering from surgery"). The same goes for the printed bulletin you post online.
- Board and council minutes: post a summary, not the full text, if they record personnel, pastoral care, or individuals' finances.
Removing a file from your site doesn't remove it from search results at once. Most search engines have a form to request removal of outdated pages.
Who has access to what
- Make a list. For each important system (email, church software, giving, website, social media, bank, domain registrar), write down who has a login and what level.
- Give the least access that does the job. The person who runs check-in needn't see giving. The volunteer who updates the website needn't have the bank login.
- One person, one login (see passwords).
- Review twice a year and after every staff change.
When someone leaves
A departing staff member or volunteer is the most common way access outlives its purpose. On their last day, not the next month:
- Disable their church email account (don't just change the password), and forward or hand over what they received.
- Remove them from the church software, the giving platform, the website admin, the domain registrar and social media.
- Change any password they knew that can't be removed, such as a shared account or the Wi-Fi.
- Get the keys, fobs and equipment back, including a church laptop or phone.
- Update the list.
Do the same, kindly, for a volunteer who steps down. It protects them, too: nobody can blame them later for something done under their login.