How Eklo protects your church’s data.
Eklo has no passwords and offers SAML single sign-on. It keeps each church’s data separate, encrypts data in transit and at rest, backs up the database continuously, and lets owners and admins export the church’s data or turn AI off at any time.
Signing in
Eklo has no passwords to steal, reuse or reset.
Emailed codes and links
People sign in with a six-digit code or a sign-in link sent to their email. Codes expire after 5 minutes and links after 10.
Passkeys and Google
Anyone can add a passkey for each of their devices, or sign in with their Google account.
Rate limits
Sign-in requests are limited per email address and per network. When one address has asked for too many codes or links, Eklo answers as usual but stops sending for a while. No limit or error depends on whether an account exists, so neither shows whether one does.
Sessions
A sign-in on a browser lasts up to 30 days after it was last used. Signing out ends it on that browser.
Single sign-on
Connect your church’s identity provider, so staff sign in to Eklo the way they sign in to everything else at work. Every church can use everything in this section during the beta; after it, each feature comes with the plans that list it on the pricing page.
SAML 2.0
Step-by-step guides cover Okta, Microsoft Entra ID and Google Workspace. Only your workspace’s owner and admins can set it up or change it.
Verified domains
Your church proves it owns its email domain with a DNS record. A verified domain belongs to one church only, and your connection signs in addresses at your verified domains and nowhere else.
Checked sign-ins
Eklo accepts a single sign-on response only if your identity provider signed it, it was meant for Eklo, it hasn’t expired or been used before, and it answers a sign-in Eklo started.
Require SSO
Make single sign-on the only way in for a verified domain. Turning it on ends the sessions of anyone at that domain who signed in another way, except your workspace owner, who also keeps an emergency email-code sign-in in case your identity provider is down.
Google Workspace domain claim
Staff at your verified Google Workspace domain join your workspace as Members the first time they sign in with Google.
When someone leaves
Remove them in Eklo. They stay out until your church invites them back: signing in through your identity provider or with Google doesn’t add them again. If they delete their Eklo account and sign up again, they count as a new person, so to keep someone out for good, also unassign them in your identity provider or suspend their Google account. Eklo doesn’t yet remove people automatically when your identity provider does.
Roles and access
Inside your church, what each person can see depends on their role, the teams and projects they’re in, what’s open to the whole church, and the forms and requests they’re part of.
Five roles
Owner, Admin, Manager, Member and Guest. Owners and admins manage people, roles and settings.
Guests
Outside collaborators see only the projects they’re added to. They can start a direct message only with people on those projects or on the teams that run them, though any member of your church can message them. They can’t see channels, teams or forms.
Private direct messages
Only the people in a direct message can read it in Eklo. Owners and admins can’t.
Invitations and removal
An invitation works only for the address it was sent to and expires after 14 days. Removing someone ends their access to your church at once, and lasts until you invite them back: single sign-on and your Google Workspace domain claim don’t add them again, and an invitation sent before the removal no longer works. The same goes for someone who leaves. Someone who deletes their Eklo account and signs up again counts as a new person.
Each church’s data, kept separate
Churches share Eklo’s servers, so the separation is built into the code that reads and writes data.
Queries limited to one church
Queries for church data are written to be limited to the church they belong to, and an automated check on every code change looks for ones that aren’t. Eklo’s staff console and some background jobs, such as clean-up, deliberately work across churches.
Tested against a real database
Automated tests try to reach one church’s data from another church’s account, and confirm that Eklo refuses.
Private files
Uploaded files are kept in private storage and opened through links that expire after 15 minutes, given only to people allowed to see the file. Files people upload for others, in chat, tasks and forms, are scanned for malware by Amazon GuardDuty before anyone can open them, and one found harmful is kept from everyone. Workspace logos and public-form cover images are public by design.
Public forms
Public form links are protected by Cloudflare Turnstile bot checks and rate limits, and visitors who aren’t signed in can’t upload files through them.
Hosting and encryption
Eklo runs on Amazon Web Services in the US East region (Northern Virginia). Its database, uploaded files, backups and logs stay in that region. The subprocessors on the subprocessors page handle some data for specific jobs, such as sending email.
Encrypted connections
The app and this website use HTTPS with TLS 1.2 or newer, and redirect any plain-HTTP request to HTTPS. Files download from storage over HTTPS too.
A private server
The application server has no public address. It accepts traffic only from Amazon CloudFront, over Amazon’s own network. That last hop, inside Amazon’s network, isn’t separately encrypted.
Encrypted at rest
The database disk, uploaded files and backups are encrypted at rest, with keys AWS manages.
A web application firewall
A firewall in front of Eklo blocks addresses on Amazon’s IP reputation list and cuts off repeated sign-in attempts from one address.
No SSH, no secrets in code
The server can’t be reached over SSH; Eklo’s engineers reach it only through AWS Systems Manager. Keys and passwords live in AWS Secrets Manager, not in the code.
One server, restored from backups
Eklo runs on one server in one AWS availability zone. If it fails, Eklo is restored from backups rather than switched to a standby.
Backups
Backups go to separate, private, encrypted storage in the same AWS region as the database.
Continuous
Database changes are copied to backup storage at least once a minute, with a full backup every night.
Point-in-time restore
The database can be restored to any moment in the last 14 days.
Tested
Backup and restore run in Eklo’s automated tests whenever the server setup changes, and every deploy checks that continuous backup is working.
Erased means erased
Data that has been erased leaves the backups within 40 days.
Your data: export and deletion
Your church’s data is yours to take with you.
Export at any time
Owners and admins can export the church’s data from Settings → Data as one ZIP: its people, teams, projects, tasks, forms, submissions, approvals, workflows and channel chat as JSON files, most also as CSV, with the files uploaded to them. Direct messages and everything in Ask Eklo (conversations, attached files, images and notes), which are private to the people in them, are left out, as are task templates, profile photos, team cover images, emoji reactions, pending invitations, email audiences and the activity history of tasks and requests. Each person downloads their own Ask Eklo data from Settings → Profile instead. Each export can be downloaded for 7 days.
Delete the workspace
The owner can delete the workspace. It can be restored for 30 days, and then every record and uploaded file in it is erased. Eklo keeps its own security records of sensitive actions, such as the deletion itself, and each person’s Eklo account stays until they delete it.
Delete your account
Anyone can delete their own Eklo account; a workspace owner hands over ownership first. What they wrote in shared spaces stays with the church, credited to “Deleted user”.
Ask Eklo and AI
Ask Eklo, the AI assistant, works inside your workspace with no more access than the person asking, and can also search the web.
Only what you can see
Ask Eklo sees the projects, tasks, channels, teams and forms the person asking can see, the people in the workspace, the files they attach to a question, their own requests, and the requests waiting on their decision: each one’s form, reference, stage, sender and when it was sent. It can’t read direct messages or the answers on a form, though it can read a channel message or task that a workflow copied answers into.
You confirm what reaches others
Anything that would notify someone else, such as a message, comment, request, approval, or a task given to or taken from another person, waits until you click Confirm. So do any change to someone else’s task (one assigned to them, or unassigned and created by them), creating or changing a form, creating a team or channel, adding people to a team, saving something for Ask Eklo to remember, and making an image. Only a few changes happen right away: adding a task for yourself or no one, editing one of your own tasks, setting or cancelling a reminder for yourself, saving a file to the Library, and forgetting something Ask Eklo was asked to remember. Undo is offered for these changes, apart from forgetting, which can’t be undone. It shows once the answer finishes, but not in a conversation reopened later.
Web search
Ask Eklo can search the web and open web pages, and lists the pages it opened or cited under its answer. Anthropic runs the searches and opens the pages. Ask Eklo writes the search words itself, so they can include details from the conversation. Web search can’t be turned off on its own; turning AI off turns it off. Once Ask Eklo has searched the web or opened a page in a conversation, or a file has been attached to it, every change it proposes there waits for Confirm.
An off switch
Owners and admins can turn AI off for the whole church. From the next question on, nothing from the workspace is sent to an AI provider.
Private conversations
Each Ask Eklo conversation, and any file attached to it, can be opened only by the person who had it, not by owners or admins, and none of it is in the workspace export. Each person can download their own conversations, attached files, images, memories and reminders in that church as one ZIP from Settings → Profile; only they can download it, for 7 days, and each request is recorded. Attached files are deleted 30 days after they’re attached, and conversations 90 days after their last message, or sooner if that person deletes their Eklo account or the workspace is deleted. The person can delete a conversation themselves, for good, while AI features are on in your church; while they’re off, an owner or admin can turn them back on, or the person can email privacy@eklo.io. Removing them from your church, or their leaving it, deletes their conversations, files and memories there; turning AI off deletes nothing. When they ask Ask Eklo to forget something, every exact copy of its words is replaced in the conversation where it was saved or forgotten; anything said in other words, or in another conversation, stays until they delete that conversation. Images Ask Eklo makes are deleted after 90 days, or with their conversation.
AI providers
Your questions, the files you attach, what Ask Eklo looks up to answer them, what you’ve asked it to remember, your name and role, and any channel, thread or task you click Summarise on go to Anthropic’s Claude, which writes the answers and also runs Ask Eklo’s web searches. Images Ask Eklo makes come from OpenAI, which receives only the description shown on the image’s Confirm card. OpenAI can also take over answers if Eklo switches providers. Both are listed subprocessors, and their business terms say they don’t train their models on this data by default.
How Eklo is built and run
The same care goes into how Eklo is built, shipped and watched.
Scrubbed logs
Eklo’s application logs mask email addresses and remove sign-in codes and tokens before they’re written. They’re kept in AWS CloudWatch for 30 days, and the server keeps a size-capped recent copy.
Monitoring
Alarms watch the server’s health, error rates, disk space, background jobs and backups, and alert Eklo when something goes wrong.
Tested changes
Changes reach Eklo’s main code through pull requests that must pass automated checks, and every merge runs the full test suite against a real database.
Supply chain
Third-party CI actions are pinned to exact versions and audited. Each release scans the API and worker images for known vulnerabilities, and the database image when it changes, and a fixable high or critical one blocks the release. The web proxy, Redis and the realtime server run on third-party images pinned to exact versions, which aren’t scanned.
Eklo staff access
Eklo staff access church data only to operate, secure and support the service, or when the law requires, as the privacy policy says.
A separate console
Staff support churches from a separate console that shows a church’s account details: its name, plan, members and support tickets. It doesn’t show tasks, chat, forms or files.
Locked to Eklo’s network
The console can be reached only from Eklo’s own network addresses.
Changes recorded
Every change staff make in the console is recorded with who made it and when, in a log the database blocks from being edited or deleted.
Server access
Eklo’s engineers can also reach the server and its database through AWS Systems Manager, to run and repair the service. From there they can reach any church’s data, not just account details, and the console’s log doesn’t record it.
No signing in as you
Eklo has no feature that lets staff sign in as you or see Eklo as you.
Policies and commitments
What Eklo commits to in writing.
Subprocessors
Eklo lists its subprocessors publicly and gives at least 15 days’ notice before adding or replacing one.
Data Processing Addendum
The DPA sets out how Eklo handles personal data for your church, including telling you within 48 hours of becoming aware of a personal data breach.
Security questionnaires
Under the DPA, Eklo answers one reasonable written security questionnaire a year.
Privacy
The privacy policy explains what Eklo collects, why, and how long it keeps it.
Report a security problem
If you think you’ve found a security problem in Eklo, or that someone has got into your church’s account, email hello@eklo.io with what you found and how to see it. Privacy requests go to privacy@eklo.io.
These contacts are also published for security tools at /.well-known/security.txt.