Who can see what

Access in Trellis follows the roles your church gives people. These limits are kept by the database itself, not only by the screens. Changing a web address doesn't show anyone more. The full detail is in the privacy policy and the security policy.

Who can see the notes and prayer requests about someone?

The leaders and co-leaders of that person's group, for their own group, and the church's admins and staff, for every group, or for their campuses' groups if their roles are limited to campuses. Leaders of other groups can't, the Communications role can't, and the person can't see what's written about them. See A person's page.

Can the office see a leader's check-ons?

No. A leader's record of reaching out to someone, and who is in a season of closer care, are private to that group's leaders and co-leaders. Admins and staff see only the date someone was last checked on. Check-ons are also left out of the data export. See Check-on.

Who can see a child's care notes?

A child's allergy, care note and pickup note are seen by admins, the Check-in role, and that day's check-in team, on the roster of the room the child is in. When door passes are on, anyone in the child's household, or its second household, who signs in to Trellis also sees the allergy, never the notes, on the Kids check-in card on Your week. The activity log records which notes changed, never what they say. See Children's care notes.

What do a door pass, a family card and a self-serve station show?

A door pass, on the parent's own phone, shows a QR, a code and the first names of the children it's for. A family card has the church's name, the family's name, a QR and a code, and no children's names, ages, rooms or allergies. A self-serve station's screens show a family's name and each child's first name and room, never allergies, notes, children's last names or a pickup code, apart from the family's own tags and stub in the print preview. See Self check-in.

What does Trellis keep about door passes, family cards and self-serve stations?

Door passes are deleted once a day, the day after the day they're for. A family card works until the office cancels or replaces it, or the family replaces it on Your week, and the old card is then kept as a record, not deleted. A self-serve station's secret is stored only as a hash, a one-way scramble, so it can't be read back from Trellis. The office can cancel a station at any time, from Settings in Check-in.

Who can see what someone gives?

Admins, people with the Finance role, and the giver themselves, on Your giving. Staff without the Finance role don't see gifts, even on a person's page.

Can a group leader see other groups?

No. A leader sees only the groups they lead or co-lead: the people, attendance, notes, prayer requests and visitors in them. They don't see the church-wide People list.

What can the Communications role see?

Lists, messages and the people record, so they can email the right people. They can see which group each person is in, to build a list by group. They never see pastoral notes or prayer requests.

Who can see private answers on a sign-up, like allergies?

The church's admins, the Registration role, and that event's managers. The person who signed up doesn't see private answers on their own sign-up page. Private answers are cleared automatically a set number of days after the event: thirty, unless the church chooses otherwise.

Who can see how a serving day went?

The write-up after a serving day can name who missed and why. Only admins, staff, the Serving role and the directors of areas serving that day can read it.

Who can see people's photos?

Only people signed in to your church. Photos never appear on public pages or in emails. Each person adds their own photo, nobody can add one for someone else, and children don't have photos. An admin can take one down. See A person's page.

What does Silas read, and is it sent to Anthropic?

Only if your church has a paid part, which Silas comes with, and an admin has turned him on. Silas reads what a task needs, like a leader's write-up with the names on that group's roster, and sends it to Anthropic's Claude model, which proposes entries. What he proposes isn't filed until a person checks it and saves it, like Done on a write-up or Use on a song, with one exception: in a service plan, his draft parts are saved as drafts, marked as his, until someone keeps or discards them, and his notes on the flow stay on the plan until someone settles or clears them. Anthropic doesn't train on it. A church that hasn't turned Silas on sends none of its records to Anthropic through him, Lighthouse AI included: it pauses while he's off. Ask Silas, the help chat, sends your question and Trellis help to Anthropic either way, never your church's records. See What Lighthouse AI reads. See also What Silas does and What does Ask Silas send and keep?.

Where is our church's data kept?

In a database run by Supabase in its US East (Ohio) region, encrypted at rest. Everything between your browser and Trellis is encrypted too. Card and bank numbers never reach Trellis; Stripe holds them. See the security policy.

Does Trellis sell our data or track people?

No. Trellis doesn't sell information or use it for advertising, and has no analytics or tracking on its pages. There are two exceptions: church emails report when they're opened, and Trellis notes each day a person opens Your week or Sunday, which only Trellis reads.

Can we see who changed a record?

Yes. Admins can open Church settings, then Activity, to see adds, changes and removals to people, groups, giving, serving, sign-ups and check-in, with who made each one. For a child's care notes it shows which notes changed, never what they say. Group attendance and private sign-up answers aren't logged. See Church settings.

Someone asked us to remove their information. What do we do?

Open their page in People and edit or remove what they asked about. If they have giving on record, Trellis asks you to mark them Inactive instead. If they're on a group roster, it asks you to take them off the roster first. See A person's page. If you need help, write to support@trellischurch.app.

Who can export everything?

Only admins. The export has everything the office keeps, including giving, notes and prayer requests, so keep it private. See Export your data.

Still stuck? Ask Silas