Security & trust
Trust is earned with evidence, not badges
Tara.OS handles donor records, pastoral notes and financial data — some of the most sensitive information a church holds. We publish what is in the product today and what is still ahead, and we don't claim certifications we don't have.
In the product today
Verified in the product- 1OrganizationEvery row carries an org id, enforced in the database.
- 2RoleSeven org-scoped roles, none of them implying the next.
- 3CapabilityDeny by default. A grant is per person, per capability.
- 4Campus scopeNarrows a permission further, where a church needs it to.
Tenant isolation
Every organization's data is partitioned at the database layer with row-level security. No query, view or export crosses organization boundaries.
Roles & capability permissions
Deny-by-default access: seven organization roles plus per-person capability grants govern exactly what each user can see and do.
Authentication & MFA
Secure sign-in with optional TOTP multi-factor authentication and Google sign-in.
Audit logging
Sensitive actions are recorded with actor, timestamp and context — and the actor is cryptographically tied to the authenticated user.
Payment data boundary
Tara never stores card numbers, CVV, bank account or routing numbers. When giving goes live, payment data is tokenized by regulated providers; Tara holds references only.
Governed AI
Ask Tara reads through the same permission model as the person asking, cites its sources, and cannot modify financial or sensitive records. AI proposes; humans approve.
Planned
Before customer data landsThese are commitments with gates attached, not marketing. Several of them — including the independent security review — block our own launch: no church's real data arrives before they are done.
Data ownership & export
Your data is yours. Full export of your organization's records, any time, with no lock-in.
Backups & tested restores
Point-in-time recovery with regularly exercised restore drills — in place before any customer's real data lands.
Independent security review
A third-party penetration test of tenant isolation and the platform, commissioned before design partners bring real data. We will not market security we haven't proven.
Incident management
A documented incident-response runbook, including privacy-regulator and affected-church notification procedures.
What we don't claim
Tara.OS holds no security certifications today — no SOC 2, no ISO 27001 — and we won't imply otherwise with a wall of grey logos. When an independent review or certification completes, you'll see it here with a date on it.