Security and privacy

Nobody reads it aloud

The breakdown goes from the member’s phone to the treasurer’s screen. Only the giver can see their own giving: signed in, or with the private token their phone keeps. Picking up an envelope tells you nothing about who used it last.

Envelopes can’t be guessed

An envelope’s code is 60 random bits, and its QR carries an HMAC signature made with a secret that never leaves our servers. Serial numbers are printed for counting sheets, and the system never accepts them as proof of anything. Typed lookups are rate-limited.

Keys and webhooks

API keys are stored as SHA-256 hashes, scoped per app, revocable, and can be limited to your servers’ addresses. Webhooks are HMAC-SHA256 signed with a timestamp against replays, go to https endpoints only, and never to private addresses.

An audit trail

Every declaration, count, key, webhook and role change records who did it (a person or an app) and when.

Counted is final

Once a giving is counted it cannot be changed. A difference is recorded as a discrepancy with a note, never by editing the declaration.