The security boundary
Django owns registration, password login, verification, recovery, session tokens, organisation and branch authorization, role permissions and ChurchHub business rules. External identities such as Google are linked into that same Django-owned account model when configured.
Safe identity linking
ChurchHub keeps one stable local account identity. External identities are linked by their provider subject, not by mutable email alone, and conflicting identities are refused rather than silently merged.
Organisation and branch isolation
Every protected Django query is scoped to organisations with an active membership. Branch-scoped memberships add a second boundary. The frontend does not receive database credentials or unrestricted Data API access to ChurchHub tables.
Protect your session
Use an individual account, keep the browser and device updated, and sign out on shared devices. Do not send session tokens, reset links or screenshots containing secrets to support. Password reset and logout should be completed from the official application domain.
Administrator responsibilities
Administrators control invitations, roles and branch scope. Grant the least access needed, review exceptional grants and remove access when responsibilities change. Sensitive exports remain the organisation's responsibility after download.
Report a security concern
Email support@stanjaysolutions.com with the time, affected page, organisation and a description of what happened. Do not attach member data or secrets unless the team provides a secure transfer method.