Church data security: a practical guide

It starts with an email

Consider a hypothetical church office manager opening an email that appears to come from a denomination or trusted vendor. It asks her to verify login credentials for a software update, and she enters the password before returning to her work.

In this composite scenario, an attacker could use those credentials to access member records, giving history, or pastoral notes. The example is illustrative; the prevention steps apply whether or not a particular breach has occurred.

This is the kind of scenario basic security practices are designed to prevent. A church can implement many of those practices without a dedicated IT department.

Why churches are targets

Churches store an unusual combination of data. Financial information (giving records, bank details for ACH donations), personal information (addresses, phone numbers, family relationships), and deeply sensitive pastoral data (marriage counseling notes, addiction recovery status, mental health concerns). Few other organizations hold this breadth of personal information with this little security infrastructure.

Attackers know this. They also know that most churches run on small teams, that volunteer turnover creates access management gaps, and that security training is rarely part of staff onboarding. Churches are soft targets with valuable data.

Data breaches are a real risk for churches of every size, especially when phishing and access-management gaps go unchecked. Treat this as a security-planning concern rather than a benchmark statistic.

The most common attack isn't sophisticated hacking. It's phishing -- fake emails that trick someone into entering their credentials on a convincing-looking login page. The second most common: reused passwords. When a staff member uses the same password for the church database and a personal shopping site, a breach at the shopping site becomes a breach at the church.

There's also a category of risk that gets less attention: insider data mishandling. A well-meaning volunteer exports the member directory to their personal laptop to work on a mailing from home. A staff member emails giving data to a board member without encryption. A former intern still has access to the database six months after their internship ended. None of these people have malicious intent, but each scenario creates a vulnerability.

The good news: you don't need a full-time IT team to protect your congregation's data. You need good habits, the right tools, and a culture that treats data protection as a form of pastoral care.

Start with password hygiene

Use unique, strong passwords for every system. This is the single most impactful security measure you can take. A password manager like 1Password or Bitwarden makes this practical even for volunteer teams --no one has to remember dozens of complex passwords.

Enable two-factor authentication (2FA) everywhere it's offered. 2FA means even if someone steals a password, they can't log in without a second verification step --usually a code from an app on your phone.

Common password mistakes churches make

Audit who has access

When a volunteer steps down, do they still have database access? When an intern finishes their summer, is their account deactivated? Many churches never revoke permissions. Over time, dozens of former staff and volunteers retain access to sensitive data.

Run quarterly access reviews. Pull up your user list, check each name, and ask: does this person still need access? If not, deactivate their account. This takes 30 minutes per quarter and dramatically reduces your risk surface.

Relius role-based permissions make this practical. You can create custom roles with granular access controls -- no IT degree required. When someone's role changes, updating their permissions takes seconds.

Build access changes into your HR process

Make permission updates part of your staff and volunteer onboarding and offboarding checklists. When someone joins the team, they get the minimum access their role requires. When they leave, their access is revoked the same day -- not the following week, not 'when someone remembers.' This isn't about distrust. It's about discipline. A clear process prevents the slow accumulation of unnecessary access that creates risk over time.

Encrypt everything

Encryption converts your data into unreadable code that can only be unlocked with the right key. There are two types you need to care about:

If your church management software doesn't mention encryption in their security documentation, ask hard questions. This is table stakes for any platform handling personal information.

Beyond your church management platform, think about other places member data lives: email attachments, shared drives, printed directories, volunteer phones. Every copy of sensitive data is a potential leak point.

The printed directory problem

Many churches still produce printed member directories with names, addresses, and phone numbers. These documents are impossible to recall once distributed. If a directory ends up at a garage sale or in a recycling bin, every member's personal information is exposed. Consider keeping directories digital-only with access controls, or at minimum, ask members to opt in before including their information in any printed material.

Plan for incidents

No security system is perfect. Having an incident response plan means the difference between a contained problem and a catastrophe. Your plan doesn't need to be complex --it needs to be written down and accessible.

Your incident response checklist

Store this plan somewhere accessible --not just on the computer that might be compromised. Print a copy. Save it to a cloud drive. Make sure at least three people know where it is.

Review the plan annually. Practice it if you can. A tabletop exercise -- walking through a hypothetical breach scenario with your staff -- takes an hour and reveals gaps you'd never find on paper. The worst time to figure out your response process is during an actual incident.

Data security isn't glamorous work. It doesn't fill seats on Sunday. But it protects the trust that does. Every family who shares their address, every giver who connects their bank account, every person who shares a prayer request -- they're trusting you with information that could harm them if mishandled. That trust is a pastoral responsibility, and it deserves the same care you bring to every other area of ministry.