The security boundary
Firebase Authentication owns sign-in: registration, password login, Google and Apple, email verification, password recovery and session tokens. The ChurchHub API owns everything after that: organisation and branch authorization, role permissions and ChurchHub business rules. It verifies the Firebase token on every request.
Safe identity linking
ChurchHub keeps one stable local account identity. External identities are linked by their provider subject, not by mutable email alone, and conflicting identities are refused rather than silently merged.
Organisation and branch isolation
Every protected query is scoped to organisations with an active membership, and the database itself enforces the same boundary with row-level security. Branch-scoped memberships add a second boundary. The frontend does not receive database credentials or unrestricted Data API access to ChurchHub tables.
Protect your session
Use an individual account, keep the browser and device updated, and sign out on shared devices. Do not send session tokens, reset links or screenshots containing secrets to support. Password reset and logout should be completed from the official application domain.
Administrator responsibilities
Administrators control invitations, roles and branch scope. Grant the least access needed, review exceptional grants and remove access when responsibilities change. Sensitive exports remain the organisation's responsibility after download.
Report a security concern
Email stanjaysolutions@gmail.com with the time, affected page, organisation and a description of what happened. Do not attach member data or secrets unless the team provides a secure transfer method.