Skip to content

A parish keeps the most sensitive records there are.

Sacramental, financial, and pastoral. The things a priest is trusted with. Here is exactly how Symphonia protects them, and where the limits are, in plain words or in technical detail.

Encrypted in transit and on sensitive fieldsdnsEvery record scoped to its parishlock_personPastoral notes kept to the priestA tamper-evident audit trailYour data, exportable any day

Encryption, layer by layer.

Everything your parish sends travels over an encrypted connection. The most sensitive fields are encrypted again before they are stored, with a key for your parish, and backups are encrypted before they leave the server.

In transit
Every connection between a browser and Symphonia is encrypted, and browsers are told never to connect any other way.
Sensitive fields, per parish
Contact details, sacramental notes, and pastoral notes get their own lock, with a key that belongs to your parish, or to the priest for pastoral notes.
Backups
Backups are encrypted before they ever leave the server, so a copied backup file is unreadable on its own.
Who holds the keys
We do. That is what lets us restore your parish after a failure and move a priest’s records to his successor. It also means our protection rests on strict access rules and audit logs, not on encryption alone.
lock_person

The pastoral seal.

A priest hears things no database should ever surrender. Private pastoral notes, the confession log, and Legacy Notes open in Symphonia only for the priest they belong to. Parish staff cannot see them, and our support sessions never show them.

For one priest
Not your staff, not an interim priest, and not our support team during a support session can open a sealed pastoral note in Symphonia. Only the priest it belongs to.
Corrected, never erased
The pastoral record is written to, not painted over. An entry can be voided but not deleted, and moving the record to a new priest is a deliberate, recorded step.
Hidden from support
If you ever ask us for help, confession and sealed pastoral content stays hidden from the support session.
dns

Kept apart from every other parish.

Every parish lives in one carefully guarded database, and every record in it is labelled with its parish. Symphonia checks that label on every request, and for the most sensitive records the database checks it again.

Scoped by parish
Each record belongs to exactly one parish, and every screen, search, and export asks only for your parish’s records.
Row-level security
For the most sensitive tables, the database itself refuses to hand over another parish’s rows, as a second, independent check.
A key for each parish
Your parish’s sensitive fields are encrypted with your parish’s own key, so another parish’s key cannot read them.

Who can do what, and the record of it.

The rector decides who sees giving amounts and who sees pastoral notes, down to the person. And every sensitive thing anyone does is written into a log that cannot be quietly rewritten.

Real roles, real limits
The rector chooses, in plain words, what each role can see and do, such as See gift amounts, Approve payments, or Read pastoral notes. A switch that is off closes that part of Studio for the role, and one person can be given an exception.
A record that cannot lie
Exports, downloads, deletions, opening someone's giving, all of it is logged, and the log is built so a tampered entry shows.
Deleted, not destroyed
Records your staff delete go to the trash first, where they can be restored, and a parish or a person can never be wiped from the database outright.

Getting in.

Passwords are stored so even we cannot read them, staff sign-in asks for a code sent by email, and anyone who wants it can turn on Face ID or Touch ID.

Passwords we cannot read
Your password is never stored as itself. Even in a worst-case leak, there is nothing to read.
A second factor
Signing in to the parish studio asks for a code sent to your email, so a stolen password alone is not enough.
Face ID and Touch ID
People who want it can confirm sign-in with a fingerprint or a face, no code to fumble for at the candle desk.
Brute force gets nowhere
Guessing at the door gets you locked out fast, not in.

When we help, the lights stay on.

If our support ever steps into your parish to help, it is with the lights on: changes are blocked, pastoral content stays hidden, and every session is written into your audit log.

We cannot change your records
While we are assisting, the studio will not let us change your records. We can look to help; we cannot act as your parish.
Pastoral stays hidden
Confession and sealed notes stay dark to us, even while we help with something else.
Every session, on the record
You can see exactly when someone from support was in, and why.
Our own tools
A small number of Ancient Designs staff can also reach parish records through our operator tools, to fix problems or to complete a priest-to-priest transfer. That access is limited to staff roles.

Money, handled the right way.

Giving runs through Stripe and settles straight into your parish's own account. We never see, and never store, a card or bank number.

We never touch the card
Card and bank details go straight to Stripe and never rest with us. There is nothing on our side to steal.
Funds go to the parish
The money lands in the parish's own account, not ours. We are the ledger, not the wallet.
Statements that reconcile
Every gift posts itself so the plate and the books always agree, and year-end statements are one click.

When things go wrong.

Hard drives fail and mistakes happen. Symphonia is backed up every night, encrypted, and copied off the server, and a restore of the latest backup is tested automatically every week.

Backups, encrypted and off-site
Your parish is backed up every night, encrypted, and kept in a separate place, so one failure cannot take it all.
Restores, rehearsed
Every week the latest backup is restored into a scratch database and checked, so we know it works before we ever need it.
Watched, and patched
The system is watched for anything unusual, and our code and its dependencies are checked for known security problems every week.
Told, if it ever happens
If a breach ever touched your parish, you would hear from us quickly and honestly, with what we know and what we are doing.

It is your data, and it stays yours.

The parish owns its record. You can take a full copy whenever you like, we never sell it, and we never train AI on it. There is no lock-in, ever.

Export any day
Members, giving history, the sacramental register, all of it, downloadable whenever you want it, and each parishioner can download their own record.
Never sold, never mined
We do not sell your parish list, we do not run ads against it, and we do not train AI on it. Full stop.
Delete, with care
Ask us to delete, and we will, keeping only what the law makes us keep, and telling you exactly what and why.

The law, where data lives, and who helps run it.

Symphonia is built to help a parish meet the privacy laws its people fall under. Your data is stored in the United States, and every provider that touches it is published, so nothing is hidden.

The laws that apply
Whether your people are in the US, Canada, or Europe, the rights privacy law gives them are built in, not bolted on.
Where data lives
Your parish’s records are stored on a server in Los Angeles, California, with encrypted backups kept off that server in Cloudflare R2.
Who helps run it
A short list of providers help run the service, such as email delivery and payments, and the list is public, with what each one receives.

Every sensitive action, written down.

And impossible to quietly rewrite. Here is the rector's own view of it.

ActivityRector only
Fr. John exported the parishioner directorytoday · 9:14 am
Mat. Mary opened giving for the Doe householdtoday · 8:52 am
A 2025 giving statement was downloadedyesterday
Reader James’s role was changed to ChanterTue
lock_personA member record was deleted from PeopleMon
Hash chain verifiedImmutable · every entry linked to the last

The questions clergy actually ask.

Can you read our confession notes?Not in any support session, and our staff do not open them. They are encrypted with a key for the priest and open in Symphonia only for him. To be plain: Ancient Designs runs the system and holds its keys, which is how we can restore your data or pass a Legacy file to a new priest, so this protection rests on access rules and audit logs as well as encryption.
What happens if Symphonia gets breached?Sensitive fields are encrypted and the keys are not kept in the database, so a stolen copy of the database or a backup shows those fields as ciphertext, not readable notes or contact details. Names are not field-encrypted. We would notify you within 72 hours with what we know and what we are doing.
Where does our data physically live?In the United States, on a server in Los Angeles, California, provided by Ethernet Servers Ltd, with encrypted backups kept off that server in Cloudflare R2. The other providers, such as Stripe for giving and Amazon for email, are listed on our sub-processors page.
Could another parish ever see ours?No. Parishes share one database, and every record carries its parish. Every request is limited to your parish, and for the most sensitive tables the database itself enforces that limit as a second check.
Do you store our members’ card numbers?Never. Giving runs on Stripe’s hosted checkout, which is PCI Level 1. We store the record of the gift, not the card. There is nothing on our side to steal.
Can we get all of our data out?Any day you like. Members, giving history, and the sacramental register export to CSV files on demand, and each parishioner can download their own record. The parish owns its record; we just keep it safe.
Do you sell our data or train AI on it?No, and no. We do not sell or broker personal data, we run no ad trackers in the product, and we never use parish data to train machine-learning or AI models.
What if we want to leave?Export everything and walk out, with no long-term contract. On the way out we return or securely delete your data within thirty days, keeping only what the law requires.
The paperwork, too.

Everything above is written into our policies, in plain language, written for a parish rather than a boardroom. Read them in full.