Security at Zionel

At a glance

• Account and workspace checks control access to private records.
• Churches must keep user permissions and recovery access current.
• Report suspected vulnerabilities privately; no service can promise zero risk.

Identity and access

Zionel protects signed-in sessions and applies role-based authorization. Church-assigned roles limit access to operational areas, and church-boundary checks are designed to prevent one church from reading another church’s records.

• Passwords are protected rather than stored as readable text.
• Passkeys and authenticator-app verification are available for strengthened sign-in flows.
• Zionel validates signed-in requests before completing protected changes.

Application and transport

Deployed environments require secure connections and use modern browser protections. Requests and uploads are validated, and private files are delivered only through authorized application workflows.

Storage, media and accountability

Church data and media are stored through access-controlled services. Uploaded images must pass validation and security checks before use. Selected security-sensitive, financial and administrative actions create accountable records.

Church responsibilities

• Assign the minimum role needed and review access regularly.
• Remove access promptly when a volunteer or employee changes role.
• Use managed devices and supported browsers for check-in and administrative work.
• Do not place secrets or unnecessary sensitive narratives in general fields.

Private care conversations

Private care conversations are stored on the service and are not end-to-end encrypted. Authorized service operations, provider processing and restricted retention remain relevant even where a screen labels content private.

Limits of this overview

No internet service can eliminate every security risk. This overview does not claim independent SOC 2, ISO or HIPAA certification, and a provider's certification does not certify Zionel.

Report a suspected issue to support@zionelchurchapp.com with Security in the subject and follow Responsible Disclosure. Do not include credentials or private church records. Any response commitment in your accepted service agreement remains applicable.

Responsible Disclosure