The office prints or displays one QR. Scanning it opens a tenant-scoped enrollment form — no app, no account.

Every enrolled member receives a lifetime member number tied to a zero-balance giving account.

Member Since Year is required; Month and Day are optional. Birth day/month without year. Nothing is synthesized.

Deactivating a member hides them from active rosters without ever deleting their contribution history.

Last/first-name sort, keyword search, and member-number lookup across the whole directory.

Members get a one-time confirmation page with their permanent number — print, save, or forget it; the office still has the record.

Members × Sundays for the month. Click a cell to add a contribution; totals update immediately.

Check number is captured on check entries. Multiple entries per date and non-Sunday entries are both supported.

Every correction stores previous value, new value, reason, actor, and timestamp. Reports always reconcile to the latest authorized value.

Each contribution carries an Idempotency-Key so an accidentally repeated save never duplicates the entry.

Every financial state transition is cryptographically linked to the previous one. Tampering is detectable.

Date range, member, or method; preview on screen, then download a signed PDF or CSV for printing or import.

14 permission codes across members, enrollment, finance, reports, users, audit, settings, and billing — grant exactly what each staff member needs.

No email mailbox is created. The same username can exist in different churches without collision.

Invitations expire in 7 days and self-destruct on claim. New staff set their own password at claim time.

Deactivating a user kills live sessions on the next request — no "stale tab" risk.

Buying ROMANS Lite doesn't automatically grant finance access. The initial admin explicitly assigns financial permissions.

Each church's data is scoped at the database and API layers — verified by automated cross-tenant tests on every deploy.