Opening TendWell
Preparing the care path.
Gathering the product, privacy, and workflow context for the next useful step.Product fitPrivacy boundaryNext step
40 days free. No credit card. Privacy review before real care data.
Report product risk without exposing pastoral records.
Security reports help TendWell fix a real issue while keeping names, prayer wording, private notes, and church exports out of the report whenever possible.
Narrow reportNo private dataClear triage
1Clear boundary2Careful access3Portable records
Security report triage
Choose the concern before sending details.
A focused report lets TendWell fix risk while protecting the people and churches represented in the data.Use security@ when the issue could affect TendWell itself.
Send a narrow security report.
Report the affected URL or workflow, browser/device context, and clear reproduction steps without including private care records.
Describe the smallest reproducible path.
Use screenshots only when they contain no private data.
Stop testing before opening or changing church records.
Safe report outline
SubjectSecurity report: possible vulnerability in [workflow]
WherePage or workflow, with no private record content.
StepsShortest path that reproduces the issue.
ContextBrowser, device, time, and whether you were signed in.
Report packet
Sensitive care stays guarded.
Send enough to reproduce the concern, not enough to expose the church.Include
- Affected URL or workflow
- Steps to reproduce
- Browser, device, and timing
Leave out
- Names and contact details
- Prayer wording or private notes
- Exports, screenshots, or logs with church data
After sending
- TendWell reviews risk and scope
- Follow-up stays narrow and privacy-aware
- Account or legal requests move to legal@tendwell.church
Responsible reporting
Report only what is needed to understand the issue.
TendWell handles pastoral-care data, prayer wording, private notes, contact details, exports, and team access. Security reports need to help fix a problem without copying, opening, changing, or sharing church data that does not belong to you.
Send reports to security@tendwell.church
Use a concise subject, the affected URL or workflow, steps to reproduce, browser/device context, and screenshots only if they avoid private data.
Do not include sensitive pastoral details
Avoid names, prayer content, private notes, contact information, exports, logs, or screenshots unless the church owns the data and the detail is necessary.
Do not access other churches' data
Stop testing when you reach data that is not yours. Do not download, alter, delete, or share it.
Use legal@ for privacy/account requests
Deletion, export, account, legal, and ordinary privacy questions belong at legal@tendwell.church instead of the security-reporting inbox.
Current security posture
TendWell uses organization-scoped data, role-based permissions, row-level security, security headers, rate limits, audit events, privacy-aware exports, and monitoring safeguards when enabled. This is TendWell's current security boundary, not a promise of perfect security, a bounty program, SOC 2 or HIPAA certification, or a substitute for your church's legal and privacy review.
Report suspected cross-tenant access, exposed exports, authentication problems, unsafe links, or privacy boundary failures.
Use the public security.txt file for the current security contact and policy location.
For urgent church-safety, mandated-reporting, medical, or legal matters, follow your church's required process outside TendWell.
Trial-ready in one church week
Security reports protect people while helping TendWell improve.
Keep reports narrow, practical, and free of private pastoral-care details whenever possible.
40-day no-card trialSunday captureMonday review