> For the complete documentation index, see [llms.txt](https://docs.lightpost.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lightpost.app/education/security.md). # Security How Lightpost protects church data, accounts, and the systems that support them. Churches entrust Lightpost with sensitive information. We design, operate, and continually improve Lightpost to help protect that data while it is in the platform. Security is not one feature. It is a set of layers that work together to reduce risk, detect suspicious activity, and limit the impact if something goes wrong. Security is also only as good as everything involved in securing data. Please be sure to read and understand the responsibility of [securing your data](/education/securing-your-data.md) as a Lightpost user as well. Lightpost can only secure what is kept in Lightpost. ## Access controls Lightpost requires users to sign in before accessing church information. Account roles and permissions help each congregation decide who can view information and perform administrative actions. Communication tools can also be limited to authorized senders. We record all user activity and review access patterns so that unusual behavior can be investigated. ## Protecting our systems We use security-focused infrastructure practices, including tightly restricted firewall rules and private-network access for internal systems. Server and infrastructure logs are monitored for suspicious activity and known risk patterns. Automated alerting helps us investigate signals that may indicate unauthorized access or an attempted attack. ## Detecting possible exposure Alongside log and infrastructure monitoring, we use internal indicators designed to detect improper access to or use of data. This includes canary contact information — email addresses or phone numbers that should never legitimately receive a message or call. Activity involving those contacts can alert us to possible data harvesting or exposure. If a congregation reports suspicious activity, we review the available user activity, access patterns, server logs, infrastructure monitoring, and other security signals to look for evidence of unauthorized access. ## Ongoing security work Security requires continual attention. Our practices include: * Automated external security scans * Regular, on-going, automated analysis for potential code vulnerabilities and concerns * Unit and integration tests that verify permissions and access controls * Monitoring and review of server and user-activity logs We do not publish every security control we have in place. We continually look for opportunities to strengthen the protections around Lightpost. ## Responsible data practices Lightpost does not sell personal data. We select the third-party services that support Lightpost with privacy and trust in mind, and we do not use free third-party services for functions where those priorities would be compromised. ## Security is shared Our platform safeguards protect data while it is in Lightpost. A downloaded PDF, spreadsheet, contact list, or directory copy can be forwarded, synced, stored, or accessed outside the platform. Its protection then depends on the people, accounts, devices, and services that hold it. Churches can help by: * Using strong, unique passwords and multi-factor authentication for email and other important accounts * Keeping devices protected and not sharing access to logged-in devices * Verifying unexpected requests for a directory, contact list, or export through a trusted contact method * Keeping data in Lightpost whenever possible and exporting only the minimum information needed Read [Securing Your Data](/education/securing-your-data.md) for practical guidance on handling exports and information requests. ## Reporting a concern For questions or concerns about Lightpost security, please contact Lightpost support.