Protected passwords
Relius stores account passwords as one-way hashes using bcrypt. Passwords are verified against these hashes during sign-in.
Data stewardship
Clear protections for the information your church stewards
Church records carry people's stories. Relius combines password protection, role-based access, and recorded administrative activity with responsible cloud infrastructure. Here is what those protections cover and what to review with our team.
How protection works in Relius
Role-based access
Administrative actions use role checks, and church-scoped data access uses your church identity. Review staff roles regularly and give each person the access their work requires.
Recorded activity
The platform’s Audit & Activity area lets administrators review recorded events and export them as CSV or JSON. Coverage depends on the operation; it is not a record of every data view or change.
Encrypted cloud infrastructure
Our production AWS database has storage encryption enabled and is not publicly accessible. The production load balancer redirects HTTP to HTTPS with a TLS 1.2/1.3 policy. Our Redis service requires encrypted connections and has encryption at rest enabled.
Database recovery
The production database has automated backup retention set to seven days and deletion protection enabled. Recovery timing and the coverage of uploaded files or external integrations should be confirmed with our team for your church’s needs.
Private file storage
The production sermon files, songs, and church media buckets have all four AWS S3 Block Public Access controls enabled. Your church should still review who can share content through the application.
Production infrastructure settings were reviewed on October 17, 2026. This configuration review is not an independent security audit. This page does not claim SOC 2 certification or establish your church's regulatory compliance. Ask our team for the documentation your review requires, including sign-in options, service providers, and recovery procedures.
Review areas
Build a security conversation around your church
Needs vary by team, plan, and the information you choose to store. Use these prompts during evaluation and ask Relius for written confirmation of the details that matter to you.
People and roles
Ask which roles can view, change, export, or remove each kind of record, and how those permissions are reviewed over time.
Sensitive information
Review how pastoral notes, care requests, giving records, and family information are separated and shared.
Activity and accountability
Confirm what administrative activity is recorded, who can review it, and how long that history is available.
Authentication and sessions
Discuss sign-in safeguards, session handling, password expectations, and the options available for your selected plan.
Export, deletion, and recovery
Ask for the current process, format, timing, and limits for data exports, deletion requests, backups, and recovery.
Service operations
Request current details about hosting, encryption, monitoring, incident response, service providers, and availability commitments.
Before migration
Agree on stewardship, not just software
Product controls are only one part of protecting people. Document who owns each decision, what your church will store, and how staff access changes when roles change.
- 1
Which records does our church consider especially sensitive?
- 2
Who needs access today, and who should approve future access?
- 3
What information would we need during an incident or staff transition?
- 4
What export and retention expectations should be documented before migration?
Get the details your review requires
Tell us about your church, plan, and review requirements. We'll share the current information available for your evaluation rather than asking you to rely on a generic promise.
Start a security conversation