Shulspace is built on the same security standards relied on by banks and federal institutions, so your members’ information, donations, and shul records remain exactly where they belong.
Built on the standards used by banks and federal institutions.
The cloud that powers Google’s own services. The edge protection trusted by Fortune 500 companies. The payment standards used by every bank. Every layer of Shulspace is built on infrastructure your kehilla can rely on.
Security & compliance details
Posture at a glance
The headline numbers.
100%
PCI-DSS compliant payment handling
100%
data encrypted at rest and in transit
3
independent tiers of defense in depth
19 / 5
controls covering all 5 NIST CSF functions
NIST CSF aligned PCI-DSS compliant payments TLS 1.2+ enforced Encrypted at rest & in transit SSO-backed admin access Google Cloud Platform
Architecture
Three independent layers of defense.
01
The edge: Cloudflare
All traffic terminates at Cloudflare before reaching the application. Web application firewall, intrusion detection / prevention, intruder sign-in detection, and bot management filter malicious traffic at the perimeter.
Shulspace runs on Google Cloud Run with managed SSL/TLS, a cloud firewall, Cloud Security Scanner running against OWASP Top 10, and reCAPTCHA on every form. Admin access is SSO-backed with least-privilege IAM.
Managed SSL / TLS 1.2+Cloud firewallCloud Security ScannerreCAPTCHASSO + IAM
03
The data: Cloud SQL (MySQL)
The database is encrypted at rest using GCP-managed keys, supports point-in-time recovery, and is IP-whitelisted to authorized development locations only. It is never exposed to the public internet.
Encryption at restGCP-managed keysPoint-in-time recoveryIP whitelist (no public access)Centralized audit logging
NIST Cybersecurity Framework
19 controls across 5 functions.
The NIST Cybersecurity Framework is the standard the U.S. government uses to evaluate organizational security posture. Shulspace maps to all five functions.
Identify
Inventory assets and assess risk.
2 controls
Asset inventory
Cloud architecture fully documented and version-controlled.
Risk assessment
Ongoing review of platform threats and dependencies.
Protect
Prevent attacks and control access.
10 controls
Web application firewall
Cloudflare WAF at the edge.
Cloud firewall
Google Cloud firewall enforced on application tier.
Cloud SQL restricted to authorized development locations only.
Credentials & SSO
All administrative access gated by SSO-backed authentication.
Awareness training
Internal team trained on a monthly cadence.
Detect
Spot threats and anomalies.
4 controls
Vulnerability scanning
Google Cloud Security Scanner runs against the application.
Centralized logging
GCP logging aggregates all system, access, and audit events.
Intrusion detection
Cloudflare IDS/IPS monitoring at the edge in real time.
Sign-in monitoring
Anomalous authentication attempts surfaced and reviewed.
Respond
Act on confirmed incidents.
1 control
Incident response policy
Documented response procedure with defined escalation paths.
Recover
Restore service and integrity.
2 controls
Point-in-time recovery
Cloud SQL supports recovery to any moment within retention.
Backup & centralized log retention
Continuous backups with centralized log archival.
Core protections
Where the protections actually live.
Three areas do most of the work: payment isolation, data protection, and administrative governance. The implementation specifics for each are below.
Payment data isolation
All cardholder data is handled by PCI-DSS validated processors via tokenization. Shulspace stores only opaque tokens that map back to a transaction at the processor.
Card data storageNone. Tokenized at the processor.
TransmissionTLS 1.2+ enforced end-to-end
PAN exposureNever visible to Shulspace staff or systems
Data protection & recovery
Member, donation, and operational records are encrypted at rest, encrypted in transit, isolated from the public internet, and recoverable to a specific point in time.
Encryption at restCloud SQL with GCP-managed keys
Encryption in transitTLS 1.2+ on all connections
Network exposureDatabase IP-whitelisted; no public ingress
RecoveryPoint-in-time recovery on Cloud SQL
Audit trailCentralized GCP logging across the stack
Administrative & operational
Human-side governance: who can access what, how staff are trained, and what happens when something goes wrong.
Admin authenticationSSO-backed identity provider
Access scopeLeast-privilege IAM roles in GCP
Awareness trainingMonthly cadence for all internal staff
Incident responseDocumented policy with escalation paths
EvidencePer-control documentation available on request
Layered prevention
What each layer keeps out.
A summary view of which attack categories are absorbed by which architectural tier.
Edge layer prevents
DDoS and volumetric attacks
Bot traffic and scraping
Known malicious IPs
Brute-force sign-in attempts
Application layer prevents
SQL injection & XSS
OWASP Top 10 vulnerabilities
Phishing form submissions
Unauthorized API access
Data layer prevents
Direct database exposure
Plaintext data at rest
Unrecoverable data loss
Tampering without an audit trail
What it means for your shul
The technical details, in everyday terms.
The specifications above are there for the people who need to see them. Here’s what they mean in practical terms for your shul, your Gabbai, and your members.
Your members’ donations are handled securely.
Card details are processed by PCI-DSS validated payment partners, the same providers trusted by major financial institutions. Donations flow safely to your shul without your team ever needing to handle sensitive payment information.
Your shul’s records are shomer.
Member lists, yahrzeits, and donation histories are encrypted, backed up, and accessible only through strict authentication, including for our own team.
Recoverable to any moment in time.
Real-time backups capture every change as it happens (every yahrzeit, every donation, every detail), so any record can be restored to any prior moment, instantly.
