If you think you've found a security problem in Atlas or on this website, please tell us. Churches trust us with their staff and member information, so we want to hear about it.
Email us, and we'll reply within 3 business days.
security@atlaschurchsolutions.comWhat to include
- What you found, and the page or address where it happens.
- The steps to make it happen again.
- What someone could do with it.
- How to reach you.
Screenshots help. Please blur out any names, emails or other personal information in them.
What we'll do
- Reply within 3 business days to confirm we have your report.
- Investigate, and tell you what we found about your report and when it's fixed.
Please
- Test only with your own account and your own church, using test data rather than real people's information. Never access, change or delete another church's data.
- If you come across data that isn't yours, stop. Don't keep, copy or share it, delete anything you saved, and tell us right away.
- Access only as much as you need to show the problem. Don't use what you find to reach further into Atlas or to keep access.
- No load testing, denial-of-service or high-volume automated scanning, and no spam.
- Don't trick or pressure our team or any church into giving you access.
- Keep the details private until we've fixed the problem, or for 90 days after your report, whichever comes first. If a fix needs longer, we'll tell you why and agree a new date with you.
Rewards
We don't run a bug bounty and don't pay for reports. We're a small team, and we're grateful for every good-faith report.
Safe harbor
If you make a good-faith effort to follow this policy, we'll treat your research as authorized. We won't take legal action against you or report you to law enforcement because of it, and we won't treat it as a breach of our Terms of Service or Acceptable Use Policy. If you come across data that isn't yours by accident, and you stop and tell us right away, you're still covered.
This covers only Atlas Church Solutions and the systems we run: the Atlas app and this website. It doesn't cover the companies whose services Atlas uses, such as Supabase, Vercel, Stripe, OpenAI, Anthropic, Resend and HubSpot. We can't give permission to test their systems, and we can't promise how they, a church or anyone else will respond. It also doesn't cover anyone who breaks the rules on this page, deliberately accesses, keeps or shares another church's data, or sets out to cause harm. Nothing here overrides the law, and if the law requires us to report something, we will.
If your report shows that a church's data was exposed, we may have to tell that church. We won't share your name without your permission unless the law requires it. We may update this policy; the version in place when you did your research is the one that applies. Not sure whether something is allowed? Ask us at security@atlaschurchsolutions.com before you test.
Not a security issue?
For help with your account, email support@atlaschurchsolutions.com. For privacy requests, email privacy@atlaschurchsolutions.com.