Security

Sub-processors

Epimely uses a small set of service providers to host, protect, and deliver the product. We do not sell church data and we do not share pastoral records with advertisers or data brokers.

Stuart Technologies infrastructure

Purpose: Application hosting, database storage, uploaded files, backups, and operations.
Data involved: Church account data, user accounts, people records, care records, audit records, and uploaded attachments.
Notes: Production data is hosted in a managed environment operated by Stuart Technologies.

Cloudflare

Purpose: DNS, edge TLS, web application firewall, rate limiting, and availability protection.
Data involved: Request metadata such as IP address, hostname, path, user agent, and security events.
Notes: Cloudflare does not receive database contents from Epimely.

Planning Center Online

Purpose: Customer-directed one-way import of church directory records.
Data involved: Only the PCO records a church authorizes Epimely to import.
Notes: Used only when a church connects its own Planning Center account.

Transactional email provider

Purpose: Invites, password reset links, access-request notifications, and account messages.
Data involved: Recipient email address, message metadata, and the email content needed to deliver the message.
Notes: Epimely supports provider-backed email or a local mail transport depending on deployment configuration.

Apple Push Notification service

Purpose: Mobile push delivery for the iPhone app.
Data involved: Device token and notification metadata needed by Apple to deliver a push.
Notes: Used only for users who install the mobile app and enable notifications.

Formal requests

Churches that need a formal sub-processor list or data-processing addendum can request one from [email protected].