Built like a bank, run like a church.

Card details never touch Churpay servers. Paystack authorises, settles and stores card tokens; Churpay keeps the record.

Paystack pays the church's own verified bank account the day after the gift. Churpay is non-custodial and never holds funds.

TLS everywhere, secrets in managed stores, backups encrypted. Documents you upload for verification are stored, not emailed around.

Owner, admin, finance, pastor, usher, kids desk and kiosk each see only their part. Staff sign-in uses a second factor.

Every approval, edit, cash count, refund and export is logged with who and when. Cash counts need a recorder and a witness.

Payment events from Paystack are signature-checked and replayed safely, so a gift is recorded exactly once.

Google Cloud in Johannesburg, South Africa. Encrypted at rest and in transit. The database sits on a private network, never on the public internet.

Only the staff the church gives permission to, area by area: giving, people, children, care. Members see only their own giving. Every staff action is logged.

Card numbers never reach Churpay. Paystack, which is PCI DSS certified, holds them. Churpay keeps only the last four digits for the receipt.

Processed under POPIA. WhatsApp and marketing consent is recorded per member, with the date and the source. We never sell or share member data.

The church can export its members, giving and 18A records as CSV at any time. A member can delete their own account from the app. No lock-in.

Automatic daily backups kept for 14 days, plus point-in-time recovery. A full restore was rehearsed in October 2026 and took nine minutes.