Some software is too important to build yourself.

The system behind your team, safeguarding, Events, payments and donations has to be secure, reliable and legally right on day one, and every day after.

Book a demo See what’s at stake

Eight things a home-made tool won’t warn you about.

The first version is the easy part. These are the moments that decide whether a home-made system protects people or exposes them, and your organisation with them.

Someone gets in who shouldn’t

A breach of children’s or safeguarding data can mean reporting to the regulator within 72 hours, telling the families affected, and a loss of trust that is hard to win back.

What you’d have to solve

Sign-in, single sign-on, two-factor authentication and password resets
Sessions that expire, and access that ends the day someone leaves
Permission checks on the server, not just hidden buttons
Seeing what someone else sees without borrowing their password
Libraries and hosting patched against new attacks

Covered by StewardStack

Sign-in and sessions run on a dedicated identity platform
Events, Safeguarding and Finance roles checked on every request
Access ends within a minute of removing someone from your organisation
Administrators can preview the app as an Event Organiser or Finance viewer, and a preview can only take access away
Each organisation’s records kept apart from every other organisation’s

It goes down, or the data is lost

If the register disappears on the morning of an Event, or a year of safeguarding records goes with a deleted account, there is no undo and nobody to call.

What you’d have to solve

Backups that run on their own, and a restore you have actually tested
Hosting that stays up when everyone signs in at once
Knowing something is broken before the people using it do

Covered by StewardStack

Your data backed up automatically and regularly
Run on professional hosting built for always-on services
Errors reported to us automatically, so we often know before you do
More than 2,000 automated tests run before every change ships

A concern reaches the wrong person

Statutory guidance expects safeguarding information to be shared on a need-to-know basis. A tool that shows every record to every user breaks that on day one.

What you’d have to solve

Different rules for safeguarding concerns and everyday incidents
Restricting a case to one lead when it involves a colleague
Letting the reporter follow up without seeing the outcome

Covered by StewardStack

Safeguarding concerns go to your safeguarding lead and their deputies alone
Restricted Incidents seen only by their lead
Reporters get a receipt and can add information, never the case notes

You’re asked to prove what happened

After an incident, an insurer, auditor, regulator or inquiry will ask who knew what, when, and what was decided. “The app didn’t keep that” is not an answer.

What you’d have to solve

A history of every change that nobody can quietly edit
Decisions recorded with their reasons, including a decision not to refer
Signed risk assessments that can’t be altered afterwards

Covered by StewardStack

Changes recorded on each person’s activity timeline
Incident decisions and their reasons kept with the Incident
Risk assessments and Event summaries signed and kept as fixed copies
Finance and donation exports logged with who ran them and when

Data protection law applies to you

Whoever builds the tool, your organisation is the controller. You answer for subject access requests, retention, deletion and every supplier the data passes through.

What you’d have to solve

Contracts with every hosting, software and AI provider involved
Retention and deletion worked out record by record
Personal data copied into test systems, spreadsheets and AI prompts

Covered by StewardStack

A data processing agreement, with us as your processor
A public privacy notice naming the kinds of suppliers we use and why
Retention you set for sensitive registration details, redacted automatically

Money goes to the wrong place

Taking payments means card security standards, refunds, disputes and money moving between families, donors and your bank. Mistakes cost families money and charities their reputation.

What you’d have to solve

Card security standards before you take a single payment
Webhooks and retries that can double-charge or lose a booking
Refunds, disputes, part payments and payment plans
Cash, cheques and bank transfers that never touch the app

Covered by StewardStack

Card details entered with a certified payment provider, never stored by us
Payments go to your organisation’s own payment accounts, chosen per Event
Event payments linked to their Order, with refunds recorded alongside
Cash, cheque and bank transfer payments recorded with how they arrived

The accounts don’t add up

Trustees sign off the accounts and answer for them. Figures from a home-made tool have to match the bank, land in the right period and get VAT and Gift Aid right, or your treasurer rebuilds them by hand.

What you’d have to solve

Refunds and disputes booked in the period they actually happened
VAT worked out across part payments, refunds and expenses
Your financial year, more than one currency, and figures that match the bank
Gift Aid and tax relief claims built from spreadsheets

Covered by StewardStack

Payments, refunds and disputes kept in one ledger for your money reports
Refunds dated when they’re made, so each period’s figures stay right
VAT on sales and on expenses summarised side by side
Expenses approved, paid back and tracked against Event budgets
Gift Aid schedules for HMRC and claim files for Ireland’s Charitable Donation Scheme

The person who built it moves on

Home-made tools depend on one person. When they leave, or the guidance changes, the tool stops keeping up and nobody knows how to fix it safely.

What you’d have to solve

Keeping Children Safe in Education, updated most years
Different checks, roles and agencies in England and Wales, Scotland and the Republic of Ireland
Code nobody else understands, whether a developer, an agency or an AI wrote it

Covered by StewardStack

Checks, role titles, agencies and deadlines matched to your Country
A Safeguarding Handbook for your Country, built into the app
A team improving it every week, with support when you need it

The costs that never show up on an invoice.

Building it yourself looks free. The price is paid in people’s time, in what your organisation can stand behind, and in what happens on the day something goes wrong.

Your evenings and weekends

Every fix, change and question lands on whoever built it, taking time away from the people and the ministry it was meant to serve.

Training and handover

Each new team member learns a tool with no guide, no training and no one to ask but its builder.

Trustee and insurer questions

Trustees, insurers, funders and partner organisations increasingly ask how data is protected. A home-made tool is hard to vouch for.

No one to call

When something goes wrong at a camp or retreat, you need answers that day. With StewardStack, you talk to people who know the product and the work.

Specialists you’d need to hire

Security, payments, accounting and safeguarding law are each a profession. Few charities can afford to employ all four, or to keep them.

Keeping up as the rules change

Safeguarding guidance, data protection and tax relief rules change. Someone has to notice, understand what it means and update the software in time.

Included with StewardStack. Yours to build if you go it alone.

Each of these is a project in its own right, to build, test, secure and maintain for as long as you hold the data.

Secure sign-in and session management
Role-based access checked on every request
Separate Events, Safeguarding and Finance roles
Need-to-know safeguarding concerns
Activity history on people, checks, Events and Incidents
Organisations’ records kept separate
Configurable data retention
A data processing agreement
Logged exports
Safer recruitment checks and renewal dates
References collected by secure link
Signed, versioned risk assessments
Incident reporting that follows statutory guidance
Rules matched to your organisation’s Country
Card payments, refunds and receipts
Cash, cheque and bank transfer payments recorded
A Finance area with VAT, budgets and expenses
Reports for your own financial year
Gift Aid and tax relief claims
Branded emails from your organisation
More than 2,000 automated tests on every change
Automatic, regular data backups
Support from people who know the work
Training for your whole team

Checked by people who don’t work for us.

Software that holds children’s details, safeguarding concerns and people’s money is exactly what attackers look for and regulators look at. “It seems to work” isn’t enough, so we hold StewardStack to recognised security standards and have it tested independently.

ISO 27001

We are working towards certification against the international standard for information security, building its policies, risk management and controls into how we run StewardStack.

Independent penetration testing

Security specialists who don’t work for us try to break in, so weaknesses are found and fixed before anyone else finds them.

External audit

Certification is decided by independent auditors checking our controls against the standard, not by us marking our own homework.

Ask us for our security and data protection details as part of your due diligence. It’s the same question worth asking of anything you build yourself.

Built by people who have done this before.

StewardStack is led by an experienced CTO who has built large-scale systems used by millions of people, and who built and sold a SaaS company where data, security and compliance were the product. We bring that experience to the parts your organisation can’t afford to get wrong: security, safeguarding, payments and the accounts.

Experienced CTO: Years leading engineering, security and data as a chief technology officer
World-class software: A track record of designing and delivering large-scale systems used by millions of people
Built and sold a SaaS company: In a space where data, security and compliance were the product
Two decades in ministry: Hands-on leadership, so we know the work as well as the software

We also run retreats, camps and gatherings ourselves. When the guidance changes or a new risk appears, we are already working on it, so your team doesn’t have to.

More than software. A team behind yours.

Most organisations don’t have the time or the budget to assemble a team that can build, secure and run software like this. You don’t need to. You get ours, and the help to make it work for your people.

Consulting

Talk through how your safeguarding, Events and finances should work before you change anything, with people who have run them and built software for them.

Training your whole team

From administrators and Event Organisers to your safeguarding lead and treasurer, everyone learns the parts they use, so nothing depends on one person.

Support when it matters

Questions answered by people who know the product and the work, including on the day of an Event.

Personal software, on solid ground

Still want to build? Build on top of StewardStack.

AI is making software personal: tools shaped around exactly how your team works. You don’t have to choose. We store, secure and manage the records. Your AI assistant connects to them, so you can ask questions, see your Events in new ways and get work done in plain English.

Which of next month’s Events still have places left?

Three do. Youth Weekend has 12 places, Leaders’ Retreat has 4 and the Family Fun Day is open.

Connected to StewardStack

Connect your AI assistant to StewardStack in a few clicks
Read only by default, and you choose what it may change
Your role is checked on every request, so it sees only what you can
Leave the organisation and its access ends with yours
It can plan Events and Tickets, but never delete records or touch payments

Questions to ask before you build.

If your team can answer every one with confidence, building your own may be right for you. If not, they are the questions we spend our time answering.

01Who fixes it at 10pm the night before an Event?
02Who can see a safeguarding concern, and how would you prove it?
03Has anyone independent tested whether it can be broken into?
04How would you answer a subject access request, or delete someone’s data?
05How would you add two-factor sign-in, or see what a user sees without their password?
06Would your treasurer trust its figures to match the bank and the right financial year?
07What happens to it when the person who built it moves on?
08What would you show your insurer, auditor or regulator after an incident?

Spend your time on the people, not the plumbing.

Your team should be running Events and looking after people, not maintaining software. Book a demo to see how StewardStack handles the hard parts, ask about consulting and training, or contact us with your questions.

Book a demo