SECURITY

Security and privacy: what church boards and IT ask

Last changed 20 October 2026.

This page answers the security and privacy questions a pastor, a church board or whoever looks after the church’s computers asks before starting: what leaves the building, who can change what, and what the network has to allow. The privacy page has every detail of what is kept and for how long.

The short version

We do not record or keep the sound of your services. We keep the words only if the account’s owner turns transcripts on; they are off until then. Turning them off deletes the transcripts kept, and their copies in our nightly backups go within 30 days.
Guests need no app and no account, and we ask them for nothing that names them.
Every connection is encrypted: the website, the console, the phones and the speech service.
Only the person who opened the account can pay, invite people, turn transcripts on or off, or delete them.
The console needs nothing installed: it is a web page, opened in a browser on the church’s own computer.

What leaves the building, and where it goes

The sound goes from the console’s browser straight to our speech service, over an encrypted connection. It does not pass through our server, and we do not record or keep it. The browser gets a key from our server that opens a single connection and expires if it is not used within a minute. Our own key for the service never leaves our server.
The words: the speech service writes down what it hears and translates it. The words then go through our server to an AI translation service to be translated, and each translated line once more to tidy its punctuation. Our server keeps none of them unless the church keeps transcripts.
The captions and the voice reach phones and screens through our relay. It holds the lines of the service so far, as text, so a phone that joins late can catch up, and deletes them when the service ends. To make the voice, the relay sends each translated line to our speech service. If the church chooses the whole-sentence voice, the lines first go through our server to the translation service, to be written for reading aloud.
Dubbed audio for a service’s video is made on the church’s own computer. About a minute of the recording is heard by our speech service to line it up with the service, and deleted there straight away; the rest never leaves the computer. The kept words are translated again as one text by an AI translation service, then read aloud by our speech service, a paragraph at a time.
The church’s account is kept in our database, and the site runs on our server, both in Oregon, in the United States. A copy of the database is made every night to separate storage, and each copy is deleted after 30 days. A logo, if the church adds one, is kept in that storage too, and our payment processor keeps the payment records.

The privacy page lists each kind of company that handles information for us and what it handles, what is kept and for how long, and how to ask for a copy or a deletion.

Accounts, passwords and who can do what

Passwords are kept only in a scrambled form that cannot be read back, not even by us.
A sign-in lasts a day, and is renewed while the console is in use, so a service is never cut off by it.
Changing a password signs out every other browser on that account within a minute.
After too many sign-in tries, for one email address or from one internet connection, further tries are refused for a while.
Sign-ins on the sign-in page, failed sign-ins and sign-ins by a confirmation link are recorded with the internet address, the browser and the rough place they came from, so we can see and stop misuse.

The person who opened the account is its owner. The people they invite can run services and change the settings, the names and the schedule. Only the owner can:

pay, change the plan or buy hours;
invite people to help run services;
turn transcripts on or off, or delete them;
make or remove the key for a Stream Deck.

Many churches share one sign-in at the sound desk. The name typed in at Go live is saved with each service, so the history shows who ran it.

Guests’ phones and the room’s screens

Guests open a link or scan a QR code. They need no account, and we ask them for nothing that names them. The phone pages carry no advertising tag.
Anyone with the link, the QR code or the short code can follow the service, as with a livestream. They read the captions and hear the voice; they cannot see or change anything in the church’s account.
The church’s link, QR code and short code stay the same every week, so printed codes keep working. It also means a link shared once works for later services, so share it as you would your livestream. If you ever need a new one, write to hello@livefy.live.
Phones use their own mobile data or any Wi-Fi. They do not need the church’s network.

The Stream Deck key

Only the owner sees the key: when it is made, and again on asking, for Companion. We keep a fingerprint of it to check each press, and a copy locked with a key that is not in our database, so that Connect can give the same key to each Stream Deck the church connects. A copy of the database alone cannot press anyone’s buttons.
Removing or replacing the key stops every button that used it at once.
A key can only do what the buttons do: start, pause, resume and end a service, switch its first caption language, turn the voice on phones on or off, and put the welcome card up or down. All it learns back is whether a service is live, paused or stopped.
Wrong keys, and presses faster than any person makes, are refused.
The buttons need Livefy’s own Stream Deck plugin, Bitfocus Companion, or another app that sends web requests, on the computer the Stream Deck is plugged into. When the owner presses Connect in Livefy’s Settings on that computer, Livefy’s plugin is handed a code that works once, for a few minutes, and trades it with Livefy for the key; the key itself is never put in a link. The plugin keeps the key in the Stream Deck app’s own settings there and sends it only to livefy.live.

For your IT person: what the network must allow

Livefy needs no incoming connections and no open ports. The computers and phones make ordinary outgoing encrypted connections, on port 443, some of them secure WebSockets (wss). If the church filters websites, allow these:

livefy.live: the website, the console, the pages phones and screens open, and the slides they show. Every computer and phone.
relay.livefy.live: captions and voice to phones and screens, over secure WebSockets, and the church’s logo. Every computer and phone.
Our speech service, which the sound goes to, over a secure WebSocket. Only the computer that runs the service. Write to hello@livefy.live and we will send its address.

Captions in OBS Studio, vMix or ProPresenter use the same addresses, as a browser source. Paying opens our payment processor’s checkout page. The console works in any current browser; Chrome or Edge is best, and sharing a browser tab’s sound works only in those. The browser asks for permission to use the microphone or sound input the first time.

Some older web filters block secure WebSockets. If the console works but captions never reach the screens or phones, check that first.

The details an IT person may ask about:

Passwords are stored with PBKDF2-SHA256, 600,000 rounds, and a separate random salt for each.
The sign-in cookie is HttpOnly and Secure, with SameSite=Lax. The site sends Strict-Transport-Security, so browsers use only encrypted connections to it.
The speech key the browser gets is temporary: it opens one connection and expires a minute after it is made.
The Stream Deck key is sent only in the Authorization header. It is stored as its SHA-256 fingerprint, and as a copy locked with AES-256-GCM whose key is kept on the server, not in the database.

Reporting a security problem

If you find a weakness, write to hello@livefy.live with what you found and how to see it. Please give us time to fix it before telling anyone else.

Questions churches ask

Does Livefy record our services?

No. The sound goes from the church’s computer to the speech service, and we do not record or keep it. The words are kept only if the account’s owner turns transcripts on. Turning them off deletes them, and their copies in our nightly backups go within 30 days.

Where is our church’s information kept?

In our database and on our server, both in Oregon, in the United States. A copy of the database is made every night to separate storage, and each copy is deleted after 30 days. A logo, if you add one, is kept in that storage too, and our payment processor keeps the payment records.

What does our firewall need to allow?

Outgoing encrypted connections on port 443, including secure WebSockets, to livefy.live and relay.livefy.live for every computer and phone, and to our speech service for the computer that runs the service (write to us for its address). Nothing incoming.

Can people outside the church follow the captions?

Yes, anyone with the link, the QR code or the short code, as with a livestream. The link stays the same every week. They read the captions and hear the voice, and cannot see or change anything in the church’s account.

Who at our church can change billing or delete transcripts?

Only the person who opened the account. People they invite can run services and change settings, but cannot pay, invite people, or turn transcripts on, off or delete them.