How is my parish’s data secured?

• Your parish’s data belongs to your parish. We do not sell it, rent it, mine it, or share it for marketing.
• No advertising, ever. No ad networks, no advertising identifiers, no cross-app or cross-site tracking.
• Least privilege by default. Every account sees only the data its role requires.
• Separation between parishes is absolute. One parish can never see another parish’s people, sessions, or files.
• You can leave with your data. Export it, or delete it, at any time.

OCIA Companion runs entirely on established United States cloud infrastructure. Your database, files, and backups are stored in U.S. data centers (Amazon Web Services, U.S. East region). We do not operate our own servers, and no parish data is stored on personal devices or office equipment belonging to us.

Our infrastructure providers — including AWS, our database and authentication platform, our application host, and our payment processor — maintain independent third-party security certifications such as SOC 2 and ISO 27001, and (for payments) PCI DSS Level 1. Those certifications belong to those providers. Credoworks LLC is not itself SOC 2 or ISO 27001 certified, and we will not claim otherwise; we build on certified infrastructure and apply the controls described on this page at the application layer.

• In transit: every connection between the apps and our servers is encrypted with TLS (HTTPS). The website is served over HTTPS only.
• At rest: the database, uploaded files, and backups are encrypted on disk using industry-standard AES-256 encryption managed by our infrastructure providers.
• Passwords: stored only as salted cryptographic hashes by our authentication provider. They are never stored in readable form, and no one at Credoworks — including the developer — can see or recover your password.

Access rules are enforced inside the database itself, not merely hidden in the user interface. That distinction matters: even if someone bypassed the app entirely and queried our systems directly, the database would still refuse to return data their account is not entitled to. Every application data table in OCIA Companion is covered by these access rules.

In practice, that means:

• Parish and classroom isolation. Directors, catechists, candidates, and sponsors see only the classrooms they belong to.
• Role-appropriate visibility. Candidates cannot view rosters, other candidates’ records, or director-only material. Sponsors see only the candidate they are paired with.
• Private means private. A director’s personal notes and a participant’s private reflections are visible only to their author — not to co-directors, not to other parish staff.
• Uploaded files are protected too. Documents in your parish’s library are not publicly reachable; access is checked and links are time-limited.

• New accounts must verify their email address before use, so an account can only be created by someone who controls the email it is registered to.
• Passwords must meet a minimum length, and every new password is screened against databases of credentials exposed in known breaches — a password that has appeared in a breach is rejected.
• Sign-in sessions are short-lived and renew automatically while you use the app. Renewal credentials are rotated on every use, and reuse of an old credential is detected and treated as a compromise signal.
• Signing out invalidates the session on the device.
• Changes to an account’s email address require confirmation before they take effect, and password reset links are single-use and time-limited.
• Classroom join codes admit a person only to the specific classroom they identify, and a director can remove any member at any time.

All payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card numbers are entered directly into Stripe’s systems and are never transmitted to, processed by, or stored on our servers. We retain only the non-sensitive facts we need to run your account: which plan the parish is on, whether the subscription is active, and renewal dates. We could not expose your card details in a breach, because we never hold them.

Access to production systems is restricted to the minimum number of authorized personnel required to operate and support the service, protected by strong, unique credentials and multi-factor authentication on the underlying provider accounts.

Administrative actions taken through our internal tools are recorded to an audit log, and administrative roles are separated so that a given role can perform only the functions it needs. We access parish content only when necessary to operate the service or to respond to a support request you initiate.

We keep our vendor list deliberately small. Each provider receives only the data required for its function:

We do not share your data with any other third party except where required by law (for example, a valid subpoena or court order).

OCIA Companion includes an optional feature that drafts quiz questions for a session. It runs only when a director explicitly requests it. When it does, we send only the session’s topic and reflection prompt — curriculum material written by the director. No candidate names, contact information, attendance, notes, reflections, messages, or any other personal information is sent. Participant data is never used to train any AI model, by us or by our providers.

The production database is backed up automatically every day, and backups are encrypted and stored separately from the live database. Uploaded files are stored on durable, replicated cloud storage.

Within the app, several destructive actions are deliberately reversible: a deleted classroom can be restored for 30 days rather than disappearing immediately, and deletions require explicit confirmation.

• While your account is active, we retain your data so the service works as expected.
• You can delete your account at any time from within the app or via our account deletion page. Personal data is removed within 30 days.
• Residual copies in encrypted backups age out on the backup schedule described above.
• Financial records related to subscriptions may be retained longer where required by law.
• Export: directors can export rosters and program data at any time, so leaving never means losing your records.

Participation in a Christian initiation program can indicate religious affiliation, which is treated as a special category of personal information under laws including the GDPR and CCPA. We handle it accordingly: it is visible only within your parish context, never sold or shared for marketing, and never used for advertising or profiling.

OCIA Companion is designed for adult formation programs and is not directed to children under 13, and we do not knowingly collect their information. Parishes whose programs include minors should apply their diocese’s own safe-environment and parental-consent policies when deciding who receives an account, and should contact us with any questions before enrolling minors.

• Application errors are monitored continuously so problems are detected and corrected quickly.
• Software dependencies are kept current, and security-relevant updates are prioritized.
• The codebase undergoes periodic internal security review, and findings are tracked to resolution before release.
• If a breach affecting your data ever occurs, we will investigate immediately, take action to contain it, and notify affected parishes without undue delay, with a description of what happened, what data was involved, and what we are doing about it — consistent with applicable breach-notification law.

Security is shared. The most effective protections a parish can apply are simple ones:

• Use a strong, unique password for your OCIA Companion account and never reuse a password from another service.
• Give director access only to staff who genuinely need it, and remove people promptly when their role ends.
• Share classroom join codes only with intended participants.
• Tell us right away if you suspect an account has been compromised.

We welcome reports from security researchers and customers. If you believe you have found a vulnerability, please email support@credoworks.net with the subject line “Security” and enough detail to reproduce the issue. Please give us a reasonable opportunity to investigate and remediate before public disclosure, and please do not access, modify, or delete data belonging to other parishes while testing. We will acknowledge your report and keep you informed of the outcome, and we will not pursue action against good-faith researchers who follow this guidance.

Parishes and dioceses conducting a vendor review are welcome to request additional documentation, including answers to a security questionnaire, under a mutual non-disclosure agreement. Contact support@credoworks.net.

This overview complements our Privacy Policy and Terms of Service, which govern in the event of any conflict.