Envelope numbers attached to people
Reissue envelopes in January and every historical gift silently re-attributes itself to the new holder. Treasurers discover this when a prior-year statement prints the wrong name.
Church • Christian Education • Stewardship • Finance • Conference • Organization
Church management software built for the congregation and the denomination above it
ChurchOS runs the local church — membership, Sunday School, Bible Study, stewardship, envelopes, the Sunday count — and the body it belongs to: district assessments, clergy credentials, conferences and consolidated reporting. One platform, one vocabulary, and a boundary between them the software will not cross.
- Membership, households and the membership roll
- Sunday School, Bible Study and CurriculumOS
- Stewardship accounts, envelopes and the Sunday count
- Assessments, receivables and clergy credentials
The demonstration is live and uses synthetic data. Sign in as any of seventeen roles and use it.
130
Database tables
A modelled domain, not a form builder
89
Row Level Security policies
Tenant isolation enforced by PostgreSQL
46
Reports
Every one a live query with CSV export
17
Demonstration roles
See the platform from every seat
The problem
Church software was built for one church. Denominations are not one church.
Most church management systems assume a single congregation with a single administrator. Point one at a denomination and the seams show immediately: every church needs its own data, its own subscription and its own administrators, while the district still needs assessments collected and the jurisdiction still needs credentials tracked and statistics reported.
The usual workarounds are worse than the problem. One shared database means every church can see every other church's giving. Separate unconnected systems mean the district collects its statistics by spreadsheet and email. Neither is acceptable when the data includes contribution records, household composition and children's rosters.
Promotion that destroys last year's roll
Editing a child's class field on Promotion Sunday erases the record of who was in Primary last year, and with it every attendance figure that depended on it.
Statistics gathered by email
Districts chase annual reports by spreadsheet because there is no way for a church to share a count without handing over the whole database.
One gift, split four ways, entered four times
Systems that cannot allocate a single contribution across several funds inflate the gift count, break the contribution statement and make “how many people gave” meaningless.
The idea the platform is built on
A tenant is not an organization
This is the rule the whole platform is built on, and it is why ChurchOS can serve a church and its denomination at the same time without either compromising the other.
A tenant is a security boundary
Data ownership, subscription, users, branding and administrative authority. A local church, its district and its jurisdiction can each hold their own tenant, each with its own plan.
An organization is ecclesiastical structure
A denomination, jurisdiction, district, church, campus or ministry. Structure is configured, not compiled: a body that uses conference and charge creates those types instead.
Being above a church grants nothing
A jurisdiction sitting above a congregation in the hierarchy reads nothing from that congregation's records. Access requires an explicit data-sharing grant that names a resource category and an access level — and the level is honoured: aggregate returns counts, not donor rows. A church that has granted nothing is reported as withheld, and is never queried at all.
Access levels a church can grant
| Level | What the recipient receives |
|---|---|
| SUMMARY | Existence and status |
| AGGREGATE | Counts and totals |
| DETAIL | Rows |
| ADMIN | Rows and administration |
A church with no grant is reported as withheld — listed, so the report's own coverage is visible, but never queried.
The platform
Everything a church runs, and everything the body above it administers
Eight modules over one domain model, one vocabulary and one permission system — so a member number means the same thing in the Sunday School roster as it does in the contribution statement.
MembershipOS
Church membership and household management
People, households, relationships and guardians, the membership roll with its own member numbers, ministries and auxiliaries, worship attendance and visitor follow-up. A person record holds identity; membership, giving, teaching and clergy standing are separate records with their own lifecycles, so a person who stops teaching does not lose their teaching history.
- Households as giving and mailing units
- Member numbers distinct from internal identity
- Guardian relationships
- Ministries and auxiliaries
ChristianEducationOS
Sunday School and Bible Study management software
Programs, terms, departments and classes; enrolment with capacity; teacher assignment; whole-roster attendance with children's check-in and check-out; promotion that preserves last year's roll; Bible Study organised by book of the Bible; and CurriculumOS, where a denomination publishes material and a church adopts it.
- Graded Sunday School by department
- Promotion that never overwrites history
- Bible Study series, lessons and resources
- Curriculum with units, lessons and objectives
StewardshipOS & EnvelopeOS
Church stewardship, offering envelopes and the Sunday count
Stewardship accounts for people, households and external donors; offering envelopes as effective-dated leases rather than identifiers; a counting workspace that allocates one gift across several funds and refuses to save until it balances; dual control between counters; batches, deposits and bank reconciliation.
- Envelope ownership resolved by date
- One contribution, many fund allocations
- Dual control between counters
- Deposits and reconciliation exceptions
FinanceOS
Church fund accounting and the accounting bridge
A fund tree with restrictions and general-ledger codes, contribution statements for members and households, pledges and campaigns, and a balanced double-entry journal handed to the accounting package the church already uses. ChurchOS owns the donor ledger and does not pretend to be a general ledger.
- Restricted and unrestricted funds
- Member and household statements
- Balanced double-entry export
- Corrections by reversal, never deletion
AssessmentOS & ReceivablesOS
District assessment and receivables management
Assessments levied by a district, jurisdiction or denomination on the organizations below it, with payments, outstanding balances and aging buckets. Issuing an assessment raises a receivable, so it ages alongside credential fees and conference registrations in one report.
- Assessment issue, payment and aging
- Receivables across every income source
- Shared aging logic, so reports agree
- Never traced to an individual member's gift
CredentialOS
Clergy roster and ministerial credential management
The clergy roster with standing and ordination, credentials with expiry derived from the credential type, requirements tracking, a renewal workflow and effective-dated appointments. Issuing a credential raises its fee as a receivable, because credential income is not a donation.
- Credential register with expiry tracking
- Requirements and renewal workflow
- Effective-dated appointments
- Fees raised as receivables
ConferenceOS
Church conference and convocation registration software
Convocations, assemblies and conventions: registration by delegate type, delegates with voting rights, a call for proposals with review and decision, tracks, rooms that cannot be double-booked, badges with scan tokens, check-in, exhibitors and a financial summary.
- Delegate registration and voting rights
- Call for papers, review and scheduling
- Badges and QR check-in
- Registration fees as receivables
GovernanceOS & ReportingOS
Church governance and consolidated denominational reporting
Offices, officers, meetings and resolutions for the deliberative body; forty-six reports across giving, education, institutional finance, credentials and conferences, each a live query with a CSV export; and hierarchy roll-ups limited by exactly what each tenant has granted.
- Offices, officers and resolutions
- 46 reports with CSV export
- Catalogue filtered by permission and plan
- Roll-ups that report withheld tenants honestly
How it works
Three things ChurchOS does that church software usually gets wrong
Each of these is a decision about the data model, not a feature bolted on afterwards — which is why they hold up years later, when the envelopes have been reissued twice and the class has moved up three times.
EnvelopeOS
An envelope number is a lease, not an identifier
Envelope 147 does not mean a person. It means whoever held 147 when the gift was given. ChurchOS stores ownership as a dated interval, so a contribution resolves through the owner on the service date — permanently. Reassign the envelope for next year and the prior interval is closed, never overwritten, and a database constraint makes two overlapping owners impossible.
A 2024 gift still resolves to the 2024 holder after the envelopes are reissued.
The Sunday count
One gift, allocated across four funds
A $500 check designated $300 tithe, $100 building, $50 missions and $50 youth is one contribution with four allocations — not four contributions. The counting screen shows the running total against the amount and will not save until they match, the service refuses an unbalanced gift, and a deferred constraint in the database refuses it a third time, so it cannot be committed by any route.
Dual control: the counter who keys a gift cannot be the one who verifies it.
Promotion Sunday
Moving a class up preserves last year's roll
A class assignment is an enrolment inside a term, not a field on a child. Promotion marks the prior enrolment promoted, writes a new one in the next term and records the movement. Nothing is edited away, so the question “who was in Primary in 2025– 2026?” has a permanent answer, and so does every attendance figure that depended on it.
Promotion into the same term is refused, because that is not what promotion means.
Who it is for
One platform, four kinds of body, four kinds of subscription
A congregation can run ChurchOS on its own. So can a district, a jurisdiction or a whole denomination — and when they all do, they connect without any of them losing control of their own records.
Local churches
Run the congregation: the membership roll, households, Sunday School and Bible Study, the Sunday count and the offering envelopes, funds and statements. Share upward only what you decide to share.
Typical rolesPastor · Church Administrator · Membership Administrator · Finance Administrator · Offering Counters · Christian Education Director · Sunday School Superintendent · Teachers
Districts and associations
Hold the church directory, levy and collect assessments, run district Christian Education and teacher training, and report on the churches that have granted you their figures.
Typical rolesDistrict Administrator · District Christian Education · District Treasurer
Jurisdictions and dioceses
Administer districts and churches, the clergy roster and credentialing, appointments, the annual convocation, governance and consolidated reporting.
Typical rolesJurisdiction Administrator · Bishop or Executive Leader · Credential Administrator
Denominations and fellowships
National and international administration: enterprise governance, national assessments and finance, curriculum administration and education standards, enterprise conferences, consolidated analytics and API access.
Typical rolesDenominational Administrator · Denominational Finance · Christian Education Administrator
Seventeen roles are available in the live demonstration — from Pastor and Offering Counter to District Administrator, Bishop and Credential Administrator. Each one enters the platform with its own navigation, dashboard and permissions, so you can see exactly what a person in that seat would see.
Security and data protection
Church data is unusually sensitive. ChurchOS is built accordingly.
Giving records, household composition, children's rosters, guardian relationships, safeguarding status and clergy standing. Four independent gates protect them, and each is enforced separately so a fault in one does not open the others.
Gate 1
Authentication
Passwords hashed with scrypt. Session tokens stored only as digests, so a database disclosure yields nothing usable.
Gate 2
Subscription entitlement
A module the plan does not include is refused by the service before any query runs — not merely hidden from the menu.
Gate 3
Contextual permissions
A grant is a role held inside one tenant and one scope. A teacher scoped to Sunday School cannot record attendance elsewhere, and safeguarding fields are removed before the row leaves the server.
Gate 4
Tenant isolation in the database
PostgreSQL Row Level Security on every tenant-scoped table, enforced against a role that cannot turn it off. A missing filter in application code returns no data rather than another church's.
Financial integrity is a property of the database
Allocations must equal the contribution, enforced by a deferred constraint that no client can bypass. Envelope ownership cannot overlap in time. Contributions cannot be deleted — corrections are made by reversal, and both records remain readable. Every action, and every refusal, is written to an audit trail inside the same transaction.
Children's data
Background-check status, safeguarding notes and restricted student notes are removed server-side for anyone without the specific permission, so the value never reaches the browser or an API response. Guardian relationships are first-class, and check-in records who handed a child over and who collected them.
Pricing
Plans for a single congregation through to a whole denomination
Local church plans are published. District and jurisdiction pricing starts where shown and varies with the number of subordinate organizations, users, modules, integrations and implementation work. Denomination Enterprise is quoted.
Local church
Local Essentials
Smaller congregations
$49
/ month
$490 per year · Two months free.
For smaller congregations needing membership, households, attendance, basic giving, communications, and basic Sunday School administration.
- Membership roll and household records
- Worship attendance
- Basic giving
- Basic Sunday School administration
- Communications
- Basic reporting
Up to 500 people · 1 organization · 5 users
Explore DemoLocal Professional
Established congregations
$149
/ month
$1,490 per year · Two months free.
Adds StewardshipOS, EnvelopeOS, advanced giving, funds, Sunday count, deposits, ChristianEducationOS, Bible Study, CurriculumOS, accounting bridge, and advanced reporting.
- Everything in Local Essentials
- StewardshipOS and EnvelopeOS
- Funds, the Sunday count, batches and deposits
- Accounting bridge (balanced double-entry journal)
- Advanced Christian Education, Bible Study, CurriculumOS
- Teacher administration and QR attendance
- Advanced reporting and data-sharing grants
Up to 2,500 people · 3 organizations · 25 users
Explore DemoLocal Premier
Large and multi-campus churches
$299
/ month
$2,990 per year · Two months free.
Adds ConferenceOS, advanced workflows, VBS, discipleship, education analytics, AI-enabled features, advanced integrations, and multi-campus capabilities.
- Everything in Local Professional
- ConferenceOS — events, delegates, badges, check-in
- Advanced workflows
- Vacation Bible School and discipleship programs
- Education certificates and analytics
- AI-enabled assistance, permission-filtered
- Advanced integrations and multi-campus
- GovernanceOS
Unlimited people · 10 organizations · 100 users
Explore DemoDistrict, jurisdiction and denomination
District
Districts and associations
Starting at
$399
/ month
$3,990 per year · Two months free. Varies with subordinate organizations, users, modules and implementation.
Church directory, district administration, assessments and receivables, district Christian Education, teacher training, district events, and reporting.
- Church directory and church accounts
- AssessmentOS and ReceivablesOS with aging
- District Christian Education and teacher training
- District conferences and events
- Organization hierarchy
- Consolidated reporting, limited by what churches grant
- Data-sharing grant administration
Up to 200 organizations · 50 users
Request District DemoJurisdiction / Diocese
Jurisdictions, dioceses and regions
Starting at
$799
/ month
$7,990 per year · Two months free. Varies with subordinate organizations, users, modules and implementation.
District/church hierarchy, clergy and credentials, appointments, assessments, conferences, Christian Education administration, governance, and consolidated reporting.
- Everything in District
- Full district and church hierarchy
- Clergy roster, CredentialOS and appointments
- Teacher certification
- Jurisdiction Christian Education and CurriculumOS
- GovernanceOS — offices, officers, resolutions
- Consolidated reporting and accounting bridge
Up to 2,000 organizations · 250 users
Schedule ConsultationDenomination Enterprise
Denominations and fellowships
Custom pricing
Quoted to the organization, its size and its implementation requirements.
Complete organizational hierarchy, national and international administration, enterprise governance, national finance and assessments, credentialing, curriculum administration, conferences, APIs, integrations, consolidated analytics, data migration, implementation support, and sponsored subordinate subscriptions.
- Everything in Jurisdiction / Diocese
- Complete national and international hierarchy
- Enterprise governance and national finance
- National assessments and credentialing
- Curriculum administration and education standards
- Enterprise conferences
- Consolidated analytics
- Public API access and enterprise integrations
- Data migration and implementation support
- Sponsored subordinate subscriptions
Unlimited organizations and users
Request Enterprise ProposalEvery ChurchOS plan includes secure tenant isolation, role-based access, audit logging, updates, and core platform support.
Need ChurchOS for an entire fellowship, jurisdiction, diocese, or denomination? We can structure centralized, sponsored, or independently billed subscriptions across your organization.
Prices are current published rates and may be revised. Taxes, optional integrations and implementation services are quoted separately.
Questions
Frequently asked questions about ChurchOS
What is ChurchOS?
ChurchOS is a multi-tenant church management platform for congregations and the denominational bodies above them. It covers membership and households, Christian Education, stewardship and offering envelopes, church finance, district assessments and receivables, clergy credentials, conference management, governance and consolidated reporting.
Can a district or denomination see an individual member's giving?
No. Position in the hierarchy confers no access. A higher body reads a church's data only where the church has issued an explicit data-sharing grant naming a resource category and an access level, and the level is honoured — aggregate access returns counts and totals, never donor rows. A church that has granted nothing is reported as withheld and is not queried.
Can each church have its own subscription?
Yes. Each church, district, jurisdiction and denomination can hold its own tenant with its own plan, users and administrators. A higher body can also sponsor a subordinate body's subscription — paying for the licence confers no access to that body's data.
How does ChurchOS handle offering envelopes?
Envelope ownership is effective-dated. Each envelope number is a dated lease on a stewardship account, so a contribution resolves through whoever held that number on the service date. Reissuing envelopes closes the prior interval rather than overwriting it, and a database constraint makes overlapping ownership impossible — so historical gifts never re-attribute themselves to a new holder.
Can one contribution be split across several funds?
Yes, and it stays one contribution. A single gift can be allocated across tithe, building, missions, youth or any other fund. The counting screen shows the running total against the gift amount and will not save until they balance, and the database refuses an unbalanced contribution independently of the application.
Does ChurchOS manage Sunday School and Bible Study?
Yes. Programs, terms, departments and classes; enrolment and rosters; teacher assignment and certification; whole-roster attendance with children's check-in and check-out; annual promotion that preserves the previous year's enrolment; Bible Study organised by book of the Bible with lessons and resources; and curriculum management with units, lessons, scripture references and objectives.
Does it replace our accounting software?
No, and it does not try to. ChurchOS owns the donor ledger — contributions, funds, envelopes, batches, deposits and statements — and produces a balanced double-entry journal for the accounting package the church already uses. It does not do accounts payable, payroll or statutory financial statements.
How is children's data protected?
Background-check status, safeguarding notes and restricted student notes are gated behind a specific permission and are removed on the server before the record is sent, so they never reach the browser or an API response for anyone without it. Guardian relationships are recorded, and attendance can record who dropped a child off and who collected them.
Is there an API?
Yes. ChurchOS exposes a documented REST API described by an OpenAPI 3.1 document. Public API access is included with Denomination Enterprise.
Can we try ChurchOS before buying?
Yes. The live demonstration portal runs a complete synthetic denomination — a fellowship, a jurisdiction, a district and two local churches — and you can sign in as any of seventeen roles, from Pastor to Offering Counter to District Administrator, and use the platform rather than watch a video.
The demonstration is live
See it with your own hands
The demonstration is a working platform loaded with a complete synthetic denomination. Record a contribution across four funds, promote a Sunday School class, run a district assessment, and try to see a member's giving from the jurisdiction — you will not be able to, and that is the point.
The demonstration portal contains synthetic data only. No real member, donor, clergy, child, church or financial records appear in it.