Security and privacy: 2FA, people's data and backups

Your church keeps people's details in WorshipPro, so it's worth a few minutes to decide who can get in and what happens to that data. This guide covers two-step verification (2FA), signed-in devices, requests about personal data, deleting an account, and our backups.

Turn on two-step verification

With 2FA, signing in takes your password and a 6-digit code from an app on your phone. You turn it on in the browser only.

1. In the menu at the bottom left, click your church's name, then Account security.
2. In Confirm password to enable, type your password and click Enable 2FA.
3. Scan the QR code with an authenticator app, e.g. Google Authenticator or 1Password.
4. Save your Backup codes somewhere safe (Copy all). They disappear after the next step.
5. Type the 6-digit code and click Confirm & enable. You'll see Enabled.

Signed up with Apple or Google? Your account has no password, and 2FA can't start without one. Set one first: click your church's name, then Sign out. Go to worshippro.net/login, click Forgot your password?, enter your email and click Send link. Open the link from the email within an hour, type a new password and click Change password. Sign in and follow the steps above. Apple and Google sign-in keep working. The code is asked for when you sign in with your email and password, so protect your Apple or Google account with its own two-step verification too.

Codes, devices and a lost phone

• In a browser, you enter a code at every sign-in.
• In the desktop app and the phone app, the device is remembered for 30 days after you enter the code. Until then your password is enough.
• No access to your authenticator app? On the code screen, click Use a backup code. You have 10, and each works once.
• New phone, or almost out of backup codes? On Account security, type your password in Confirm password to disable, click Disable 2FA, then turn it on again. You get a new QR code and 10 new backup codes. The old ones stop working.
• No app and no backup codes? You can't finish signing in on your own. Write to contact@worshippro.net from your account's address.

If your role requires 2FA, turning it off can lock the modules listed below straight away. They open again as soon as 2FA is back on.

Active sessions, on the same page, shows where your account is signed in: device, IP address and last activity. Revoke ends one session. Sign out other devices ends all of them except This device. There's no list of remembered devices, so after losing a phone or laptop do two things: click Sign out other devices, then set a new password with Forgot your password?.

Requiring 2FA in your church

Settings → General, Security tab. You need Church settings: Manage (Owner, Administrator).

2FA is always required from anyone who:

• manages the people directory,
• has any Finance permission,
• manages church settings.

The switch Require 2FA from everyone who can see the people directory adds everyone who only views it, including Leaders. Songs, plans and the roster are never affected.

Each person has 14 days from the moment the requirement applies to them, and sees a bar with the days left. After that, People, Finance and Church settings are locked for them. Everything else keeps working, on the phone too. Access returns as soon as they turn on 2FA. You don't need to do anything, and you can't turn it on for them.

When someone asks about their data

Your church decides about the data in its directory, and we process it on your behalf. The tools are on the person's page: People → Directory, then open the person. You need People: Manage (Owner, Administrator).

Export data downloads what the church holds about the person as a JSON file. Sensitive notes and donations are included only if you have access to them, so for a complete answer ask the Owner to run the export.

Anonymize is how you delete a person. There's no separate delete button. Type ANONYMIZE to confirm. This can't be undone.

• Gone: name, contact details, birth date, photo, health notes, notes, consents and guardian links.
• The person leaves teams and groups, and the card is unlinked from their account.
• What stays: an empty card under a placeholder name, so serving and attendance counts stay correct.

Two things stay separate. Anonymizing doesn't close the person's WorshipPro account or remove them from your church: if they're a member, also click Remove on the Settings → Members page. A donor record in Finance has its own Anonymize button.

The Privacy (GDPR) tab (Settings → General) is about your own account, not other people. Export my data (GDPR) and Request data deletion add an entry to Recent requests, but that list has no download button yet, and a deletion request isn't carried out by itself. For a copy of your account data, or to have it deleted, write to contact@worshippro.net from your account's address.

Deleting an account

You delete your own account in the phone or tablet app: Settings → Account → Delete account, then confirm (with your password, if the account has one). The browser and the desktop app have no such button. Without the phone app, write to contact@worshippro.net from your account's address.

Deletion is immediate and can't be undone. You're signed out everywhere, and your sign-in details, memberships and settings are deleted. Songs and plans stay in the church without your name. Your directory card stays until the church anonymizes it.

If you're the only Owner or Administrator of a church, hand over that role first (Settings → Members). If the whole church is leaving WorshipPro, write to us. More: Deleting your account.

Backups

Backups run without you:

• every night we copy the whole database and all files, encrypted, and store them in the EU,
• we keep copies from the last 7 days, 4 weeks and 6 months,
• after a serious failure you'd lose at most the last day's changes, and we'd be back within 4 hours.

There's no restore button in the app. If someone deletes something important by mistake, write to contact@worshippro.net right away, and we'll check whether it can be recovered. The status page shows when the latest backup was made. More: Security.

What's next

• Your team in WorshipPro: invitations, church link and roles
• The people directory: people, households, import and notes