Security at CAST

What CAST Holds

Only what public-talk scheduling needs: speakers' names and congregations, their email addresses and phone numbers, and the dates and outlines of talks. CAST holds no confidential congregation records, no publisher records, and nothing from the field ministry.

Where CAST Runs

• Vercel serves every CAST site and runs its application code. Nothing is hosted on a computer in anyone's home or office.
• Neon (managed Postgres) holds the database, encrypted at rest, with a separate copy of the data for rehearsing changes before they reach production.
• Google Workspace provides CAST's own email and the Google connection through which a congregation's confirmations go out. Card payments are handled by Square.
• Access to each of these providers is held by the IGS Global team only, behind two-step sign-in.

Your Data in Transit and at Rest

• Every CAST site is served only over HTTPS, and browsers are told never to connect without it (HSTS).
• The email addresses, phone numbers and other contact details CAST keeps for speakers and congregations are encrypted one by one (AES-256-GCM) before they are stored, with a key the database never sees. In a copy of the database, even at our hosting provider, they are scrambled text. (The sign-in address of each CAST account stays readable so that signing in works; it is covered by the database's own encryption.)
• The database is also encrypted at rest by our hosting provider, and the keys CAST keeps for each congregation's Google connection are encrypted again by CAST.
• Files that arrive with a congregation's email (an outline, a letter) are encrypted before they are stored and are opened only through short-lived signed links that expire in ten minutes.
• Public pages show only what a speaker needs to book: dates, speaker names, congregations and outline titles. Never an email address or a phone number.

Signing In

• Every account signs in with a password and a second step (an authenticator app or a passkey), with one-time backup codes.
• Passwords are stored only as slow, salted hashes. Sessions can be ended from anywhere and expire when idle.
• Repeated failed sign-ins are slowed down and locked out. Every sign-in and account change is recorded.

Each Congregation's Data Stays Its Own

• The database itself keeps each congregation's records apart (row-level security), so one congregation's coordinator cannot read another's, even through a programming mistake.
• Every action in the console is recorded in an activity log: who did what, and when.

Email and Payments

• Confirmations and reminders go out from the congregation's own Gmail through a connection verified by Google. CAST can send email and add calendar invitations. It cannot read the inbox.
• Card payments are handled by Square. Card numbers never reach CAST's servers.

Watching Over It

• Automated checks run every hour that the service is working, and every week that its security settings are in place. Each run is kept as a record.
• CastAi, our assistant for coordinators, works under its own rules: how CastAi handles your information.
• Every CAST host is checked against the public graders. The reports are open to anyone: SSL Labs for the connection, and the MDN HTTP Observatory for the response headers. The next step on the Observatory is a stricter content security policy, which is in progress.
• We are working toward an independent SOC 2 examination. We will say so here when a report is available.