Accounts and families, in depth

A parent signs in with an email address and a password. The account opens the household record that the parish keeps. That record holds the adults, the children, the contact details, the sacrament details and the safe environment dates. Every other module reads the same record. A parent corrects an address once, and the correction is the same in Faith Formation, in Conferences and in Communications.

The portal asks for a fresh confirmation before it changes something sensitive. Examples are a new password, a new sign-in email, or the removal of a device. The parent types the password again, or asks for a one-time code by email. This rule applies even when the parent is still signed in. The app does not resubmit the change by itself. The parent confirms, then presses the button again.

The Devices tab lists the browsers where the parent chose Remember me. The list shows the browser, the system and the date of last use. A device drops off the list after 14 days of no use. The list keeps at most 10 devices. The oldest one leaves first.

Two actions end sessions:

• Remove stops one device from staying signed in. An active session on that device runs until it expires.
• Sign out of all devices ends every session at once, including the current one.

A change of sign-in email signs the parent out everywhere. The server sends the code to the new address only.

A parent who cannot sign in starts recovery from the sign-in page. The server sends a six-digit code by email or by text. The code works for 10 minutes and for five tries. The answer is the same whether or not the address matches a parish record, so a stranger learns nothing about who has an account.

When a code is not enough, the server asks for more details. These are the last name, the date of birth and the home ZIP code, plus one more detail. A wrong answer never says which detail missed. After a few failed tries, the automatic check stops for 24 hours. The server then opens a help request with a reference number. Staff use that number to find the case.

Parents see their own household and nothing else. Staff see the Admin Tools menu only when they hold a role.

• Module roles open one admin panel each. A Payments admin does not see the Communications panel.
• Global admin is the widest role. Only a global admin adds or removes admin roles, and nobody can change their own roles.
• A role change is live at the person's next sign-in. There is no confirmation step, so a mistake is fixed by adding the role again.

Module visibility hides a module from the sidebar and from the home page. It deletes nothing, and admins still see the module. It does not block a person who already has a direct link, so use it to tidy the menu and not to lock a module.

Impersonation lets a global admin open the portal as a parishioner who has a parish record. A red bar shows on every page while it runs. Every action counts as the parishioner's action. The parishioner receives no message. Use it to see what the family sees, and stop when the check is done.