Security

What we access

Planning Center

We ask Planning Center for the giving scope only: read access to Giving. We read funds, campuses, gifts and their fund designations, refunds and batches. Nothing in Constat writes to Planning Center.

QuickBooks Online

We ask Intuit for the com.intuit.quickbooks.accounting scope, which QuickBooks requires for both reading and writing. We read your company settings, accounts, classes, locations, items and payment methods so you can map funds, and we look up the transactions we posted. We write:

• one deposit per payout or batch (and, in the clearing-account model, the fee expense and the transfer to the bank);
• in detail mode, which is off unless you turn it on, a sales receipt per gift and a refund receipt per refund, with the customers (one per donor) and items they need;
• an account, class, location or payment method only when you click "Create for me".

Nothing posts until someone with approver access approves it, or until an approver turns on auto-post for payouts that tie out exactly. Every object we create is recorded before it is sent and carries a reference to its payout, so a retry never creates a second deposit. Every night we check that the deposits we posted are still in QuickBooks.

Disconnecting

You can disconnect either service from Settings, Connections. If you disconnect Constat from inside QuickBooks, Intuit tells us and we mark the connection revoked once Intuit confirms the access is gone. Nothing posts while QuickBooks is disconnected.

What we store

• Your account: name, email address, the churches and firms you belong to and your access level in each. Passwords are optional and stored only as a hash by our authentication provider.
• Giving records from Planning Center: gift amounts, dates, fund designations, payment method, processing fees, refunds and batches. Donor names and email addresses are pulled from Planning Center only when your church turns on Keep donor names and email addresses (detail mode turns it on, because each donor becomes a QuickBooks customer). Turning it off deletes the ones pulled before; names already written to QuickBooks stay in QuickBooks and in our record of those customers.
• Payout files:the payout emails and CSV files you forward or upload, in private storage. Each file's type is checked from its contents and it is scanned for viruses before it is read; infected files are deleted. Downloads are logged. We keep the payout rows and amounts read from each file. The original file is kept too, unless your church turns off Keep original payout files; then it is deleted once it has been read. Raw payout files you keep may contain donor names; parsed rows never do.
• What we posted: each QuickBooks object we created, its id, and the request and response, so every deposit can be traced back to its payout.
• An audit log of approvals, postings, connection changes, setting changes and file downloads. Audit entries cannot be edited or deleted by anyone using the app.

Suggestions from a model

When we cannot read a payout file's columns, a person at your church or firm can ask Anthropic's Claude model to suggest how to map them. We send only the column names, the totals of the amount columns and up to five rows with names, descriptions, contact details, card digits, account numbers and notes removed. That person confirms every mapping before any file is read with it; a suggestion is never applied on its own. Where reading a PDF statement is switched on, we also send the lines of a text PDF that contain an amount, with names, email addresses and long numbers removed, to read the payout totals; we never read individual gifts or donors from a PDF, and a PDF whose totals do not balance to the cent is not used.

Model-assisted features stay switched off until Anthropic processes these requests under zero data retention.

How we protect it

• Planning Center, QuickBooks, Pushpay and Xero access tokens are encrypted at rest with AES-256-GCM, using a key held only in our hosting environment. Tokens are never sent to your browser.
• Every database table enforces row-level security: a person sees only the churches and firms they are a member of, at the access level they were given. Donor names are visible only to reviewers and above.
• All traffic uses HTTPS, and browsers are told to refuse plain HTTP (HSTS). Pages cannot be framed by other sites.
• Sign-up and sign-in forms are rate limited and protected by a bot check.

How long we keep it

We keep giving records, payouts and payout files until your church deletes them.

Parsed payout rows and amounts until your church deletes them; the original payout file too, unless you turn off Keep original payout files.

How you delete it

Disconnect in Settings, Connections deletes the access tokens we hold for that service, so syncing (Planning Center) or posting (QuickBooks) stops. We also ask Planning Center or Intuit to revoke the access.

A church owner can delete the church from Settings, Export and delete. Export your payouts, payout lines, postings and fund mappings as CSV first if you want a copy. Deleting:

• revokes our access at Planning Center and at Intuit;
• deletes every payout file, synced gift, payout and mapping we hold for the church;
• keeps the audit log, with the church removed from it, as the record that the deletion happened. Nothing is deleted in QuickBooks or Planning Center.

Syncing and posting stop as soon as the deletion is requested.

Subprocessors

These companies process data on our behalf. We will update this list before adding a new one.

Report a vulnerability

Email [email protected]with "Security" in the subject. Tell us what you found and how to reproduce it. We will confirm we received it, keep you updated while we fix it, and credit you if you would like. Please do not access another church's data, degrade the service, or disclose the issue publicly before it is fixed.