Security

Planning Center is SOC 2 Type 2 certified. The American Institute of Certified Public Accountants (AICPA) created the Service Organization Control (SOC 2) framework to test organizations’ ability to protect data from potential threats.

To pass SOC 2, we worked with an AICPA-approved auditor, Johanson Group, to critique our company based on five areas: security, availability, processing integrity, confidentiality, and privacy. This audit included a review of our policies, backup and disaster recovery, incident response, firewall configurations, and other critical areas of our business. After completing the audit, we received an Auditor’s Report, proving Planning Center meets and exceeds the SOC 2 criteria. We can provide the full report upon request.

The Payment Card Industry Data Security Standards (PCI DSS, or more commonly, PCI) are a set of standards set forth by the four major card associations to protect cardholder data. All merchants and processors need to have physical, electronic, and procedural controls in place to ensure that cardholder data is stored and handled securely at all times.

Planning Center is a PCI Level One compliant merchant.

Our payment processor, Stripe, is one of the largest, most advanced payment processors in the world. They handle payment processing for services like Kickstarter, Lyft, Shopify, Pinterest, Twitter, Heroku, SurveyMonkey, and many other companies. Stripe is also a certified "PCI Service Provider Level 1" payment processor.

Whenever your data is in transit between you and us, everything is sent encrypted over HTTPS, and our databases utilize encryption at rest. We limit brute force attacks with rate limiting, and all passwords are filtered from all our logs and are one-way encrypted using industry standard bcrypt.

We hire the best developers we can find. Since so many security exploits take advantage of coding errors, part of security is having well-tested, well-reviewed code. At Planning Center, code changes are reviewed by teammates, ran against an automated testing framework, and in most cases, manually QA’d. By the time new code is running on our production environments it has had lots of eyeballs on it. Developing this way means that it takes more time to get things done, but it also means that fewer mistakes get by.

We employ a multilayered backup strategy that is designed to be resilient to hardware failure, regional disasters, and malicious acts. Both point in time backups and daily snapshots are available for use in recovery.

We run an ongoing bounty program through HackerOne to provide penetration testing across all of our products. These security researchers are some of the best in the world at finding vulnerabilities and responsibly disclosing them.

Our bounty program is open to anyone who finds a security vulnerability. To report a vulnerability, please start by requesting an invite to our program by email at hackerone@planningcenter.com. Our average response time is less than one day.

All of your data is stored in AWS data centers, which use industry leading practices in physical security, redundancy, and availability. You can learn more about Amazon's data centers here.

At the most basic level, our main physical space is locked and alarmed during off hours. In the event of a break-in, we may lose some expensive monitors, but since our servers don't reside in our buildings, they aren't vulnerable to smash-and-grab robberies. Local computers are password protected and encrypted. In the course of conducting customer support, employees access customer data using an encrypted connection and must invoke a time-based one-time password upon connection.

Planning Center is a small company, so thankfully we are able to hire some brilliant people who care about its success. Our employee turnover is extremely low (especially for the tech industry). To protect company data, including customer data, all employees sign a non-disclosure agreement when hired.

Lastly, a word about the culture here in general. Most of us who work at Planning Center are also users of our software. Our personal data is in the same database as our customers. We've checked-in our children using Planning Center Check-Ins at our own churches. We've donated to our churches using Planning Center Giving. We protect your data like it’s our data because it is our data.