Named operations only
Products receive specific reads and commands for documented jobs—not unrestricted database clients.
Your data is yours.
The architecture
should prove it.
Trust cannot depend on a promise that every product, administrator, or AI model will always behave perfectly. Stroma is designed around explicit ownership, least authority, isolation, and recoverable change.
Where records live
The control plane is not the church database.
Stroma's platform control plane stores platform metadata such as identity, organizations, entitlements, provisioning, and routing. Church and product records live in the resolved church data plane.
That separation is foundational: the system that coordinates access does not silently become the owner of ministry data.
Independent permissions
Application permissions remain distinct from broad organization roles and are rechecked at product boundaries.
Isolation by default
Each product owns its schema, migrations, failure boundary, and operational contract. One product cannot casually read another's records.
Lifecycle enforcement
Disabling an app or suspending a church denies access at the documented next-check boundary without deleting church data.
Safe public delivery
Websites receive typed public projections and same-origin media—not storage credentials, raw bucket paths, or private records.
Auditable change
Migrations are ordered, deterministic, idempotent, checksummed, and tracked per environment and product.
Practical boundaries
Enough access to do the work. No more.
A public website
Published locations, events, sermons, stories, and approved media.
Not private member profiles or storage credentials.A scheduling app
Eligibility, availability, team context, and approved contact methods.
Not giving history or counseling records.An AI drafting assistant
Approved content, audience context, event details, and voice guidance.
Not unrestricted database access or hidden pastoral notes.Current posture
Guided early access, not blanket readiness.
Stroma has substantial working foundations and local or hosted evidence across multiple products. Important production-church, provider, recovery, accessibility, load, and operational gates remain. Every pilot is bounded to the exact product and evidence available.
Guided early access
Start with one meaningful workflow.
We'll learn your church's context, identify a bounded first step, and be direct about what is ready today.
Start a conversation