Your church workspace stays its own boundary.

Identity is not workspace authority

Signing in establishes identity; it does not automatically grant access to a church workspace. The server checks workspace membership and role permissions for protected actions.

Storefront purchases, customer-portal accounts, and other Carlo Orlando Leadership products remain separate and cannot silently create Church Staff Meeting access.

Church workspaces remain separate

Each church workspace owns its membership, meeting series, preparation, meeting history, ratings, decisions, notes, and Action Steps. Church Staff Meeting is kept separate from the COL storefront, customer portal, and Leadership 360 confidential service.

Integrations require deliberate action

Planning Center remains read-only and preview-only. Basecamp requires an explicitly selected destination plus human review and approval of Meeting Notes and Action Steps before sending.

Other external writes remain disabled until their own release gates pass.

Data protection and recovery

Access controls, fail-closed provider behavior, content-minimized operational receipts, and synthetic release testing are part of the current design.

Customer content remains customer-controlled while the workspace is active. A verified workspace owner may request export or deletion. Active records are targeted for deletion within 30 days after an approved request or termination; recovery copies are targeted to age out within 30 days. Legal or security holds can delay deletion. These are owner-selected operating policies, not a hosted recovery or RPO/RTO claim.

• Do not send passwords, secret tokens, or raw meeting exports to ordinary support.
• Backup and restore claims require a separate hosted recovery receipt.
• No compliance certification or guaranteed recovery objective is claimed.

Report a security or privacy concern

Send a concise description to Carlo@carloorlando.com and identify the affected workspace without including passwords, tokens, or unnecessary church content.

Email intake is accepted 24/7. Staffed support is Monday-Friday, 9:00 AM-5:00 PM Eastern Time, excluding US federal holidays. The target first response is within 1 business day; urgent security reports target acknowledgment within 4 business hours. No SLA is promised.