1. Security & Access Control (Server-Enforced)

• ✅Real sessions: signing in issues a random opaque token (6-hour expiry) held server-side; every later request must present it.
• ✅Single guarded entry point: all data flows through one callApi dispatcher that validates the session before anything runs.
• ✅Closed by default: data are private to the server and unreachable from a browser; nothing is exposed by accident.
• ✅Role enforcement at section level: e.g., a Finance Officer is refused user administration by the server, not just shown a hidden menu.
• ✅Role enforcement at subsection level: a Configs-only role cannot reach Access Control; a Reports role cannot pull another department’s finances by changing the request.
• ✅Tamper-proof audit log: the recorded actor comes from the validated session, never from the browser, so log entries cannot be forged.
• ✅Sign-out ends the server session (not just the page).
• ✅Expired sessions prompt a clean re-login rather than failing silently.
• ✅Login throttling: one code per minute and five per day per user for increased security.
• ✅Brute-force protection: an access code is destroyed after 5 wrong attempts.
• ✅No account discovery: the login screen replies identically for known and unknown emails.
• ✅Injection-safe output: all user-supplied text is escaped before it reaches an email or the page.
• ✅Runs over HTTPS with a genuine SSL certificate.
• ✅Independently audited: two external security audits conducted; every finding fixed and verified.

2. Membership

• ✅Full member profiles: 19 fields (name, position, sex, date of birth, email, phone, marital status, date of marriage, address, country of origin, department, baptism status, baptism date, join date, church status, department status, notes).
• ✅Random 6-digit member IDs: unique, non-sequential, no prefix.
• ✅Add / edit / view members.
• ✅Smart form: marriage and baptism dates appear only when relevant.
• ✅Search & filter the member list.
• ✅Automatic Active / Inactive status: based on last contribution or join date.
• ✅Configurable inactive period (in days).
• ✅
  Automatic deletion of long-inactive members (optional retention policy):

  • Counted after a member is marked inactive.
  • Disabled entirely when the period is blank or 0.
  • Any contribution resets the clock.
  • Preview before enabling; guardrail warning on very short periods.
• ✅Manual deletion removed: members leave only via the retention policy.

3. Finance: Main Church

• ✅Income & expense recording.
• ✅Conditional form logic: asks only for what’s relevant to the entry.
• ✅Income sources: member, named donor, or anonymous.
• ✅Department-directed income: income recorded to a named department.
• ✅Expense purpose capture.
• ✅Payment method (required).
• ✅Categories driven by Config.
• ✅Edit & delete transactions: with confirmation, fully logged.
• ✅Live ledger of recent transactions.
• ✅Member notification email on transaction add, update, and delete.

4. Finance: Departments

• ✅Separate books per department: own sheet, own records.
• ✅Income & expense recording with department-specific categories.
• ✅Payment method (required).
• ✅Edit & delete transactions: logged per department.
• ✅Department member roster (view).
• ✅Exact department matching: no cross-department bleed.
• ✅Member notification emails on all actions.

5. Dashboards

• ✅General Dashboard: total membership, male/female counts, active count, baptised count, gender chart, department chart.
• ✅Upcoming birthdays (next 30 days).
• ✅Upcoming marriage anniversaries.
• ✅Upcoming baptism anniversaries.
• ✅Financial Dashboard (church): income, expense, balance, trends.
• ✅Financial Dashboard per department.

6. Reports: All A4, Print-Ready

• ✅Income & Expenditure Statement: income by category, expenditure by category, period summary (income / expenditure / net), account summary (balance brought forward, net, total balance).
• ✅Automatic balance brought forward: net of all transactions before the period.
• ✅Payees / Contributors List: unique payers with totals; covers members, named donors, and anonymous.
• ✅Statistical Report: membership, male, female, active, inactive, new members, baptisms, marriages, birthday/baptism/marriage-anniversary celebrants, members by department.
• ✅Individual Member Statement: join date, church contributions, per-department subtotals, grand total, and a full breakdown with “Given To”.
• ✅Category multi-select with clear-all.
• ✅Member search filter on the statement.
• ✅Date range + quick periods (this week/month/quarter/year, last year, all time).
• ✅Print button: prints only the report.

7. Birthdays

• ✅Own section: delegate without exposing main settings.
• ✅Customisable greeting with {name} and {church} placeholders.
• ✅Automatic daily sending (~7 AM).
• ✅Send-once-per-day protection.
• ✅Preview today’s birthdays (without sending).
• ✅Send test greeting.
• ✅Enable / disable with live status.
• ✅Signed by the church.

8. Church Settings

• ✅Church name, address, logo.
• ✅Logo upload: auto-resized, stored in-app (reliable).
• ✅Logo by URL: Google Drive links auto-converted.
• ✅Currency selection: all ~160 ISO currencies.
• ✅Currency applied everywhere: amounts, dashboards, reports, and the amount-entry symbol.
• ✅Configurable lists: income categories, expense categories, departments, positions, department income/expense categories, marital statuses, payment methods, asset categories, asset conditions.
• ✅Inactive period and deletion period settings with inline guidance.

9. Assets Register

• ✅Own section: can be delegated to a property/logistics officer without exposing other areas.
• ✅Record church property: asset ID, name, category, description, quantity, station/location, condition, date acquired.
• ✅Auto-generated asset IDs.
• ✅Add / edit / delete assets.
• ✅Category & condition dropdowns driven by Config.
• ✅Colour-coded condition badges (new/good/fair/damaged).
• ✅Search across all fields.
• ✅Confirmation before deletion.
• ✅Every action logged to the Activity Log.

10. Audit & Accountability

• ✅Activity Log: who did what, when.
• ✅Correct user attribution: records the signed-in app user, not the Google account.
• ✅Tracked actions: member add/update, asset add/update/delete, transactions add/update/delete (church + departments), config changes, church info updates, role changes, access grants/removals, birthday email runs, auto-deletions, logins, access codes.
• ✅Searchable log viewer (latest 500).
• ✅Permission-controlled: its own System Record section.

11. Asset Reports

• ✅Asset Register report: filter by acquisition period, category, and condition.
• ✅Assets by Condition report: items, quantity, and percentage share per condition, with a category breakdown.
• ✅Acquisition dates on assets.
• ✅Undated assets flagged, never silently dropped from a dated report.
• ✅Both A4, print-ready, with church header and signature line.

12. Unique Domain & App Installation

• ✅Every Church has a unique domain with a dedicated login page.
• ✅Installable on phones and tablets: Add to Home Screen (iPhone) or Install app (Android).
• ✅Installable on computers: download the app to your computer and use it anytime without opening any browser.
• ✅Opens Fullscreen with your icon: no browser address bar; indistinguishable from a native app.
• ✅Per-church identity: each church installs under its own name.
• ✅Branded splash theme and screen while the app opens.
• ✅Graceful fallback: a direct link appears if the app can’t load.

13. Platform & Experience

• ✅Works on desktop, tablet, and phone: slide-in drawer on mobile.
• ✅In-app Refresh System: reloads data without logging out.
• ✅Clickable brand → home.
• ✅Graceful Work platform branding (sidebar, mobile bar, login).
• ✅Church branding (app header + all reports).
• ✅No native browser popups: clean in-app dialogs and messages.
• ✅Lazy view loading for speed.
• ✅Demo mode: one flag disables all email and scheduled jobs, shows a visitor warning banner.

14. Deliberate Design Decisions (Not Gaps)

• ✅Open setup mode: a fresh workspace is unauthenticated until the first user is added, so it can be configured. Adding the first administrator is therefore a security step, not just setup.

Not Included in Mini (Candidates for COS Pro)

• 🔲Church-defined custom departments (the five are fixed).
• 🔲Multi-branch support with consolidated view.
• 🔲Online giving / payment gateway.
• 🔲Bulk annual statements with PDF attachments.
• 🔲SMS / WhatsApp notifications.
• 🔲Member self-service portal.
• 🔲In-app data export & backup.
• 🔲Attendance tracking.
• 🔲Events / calendar.
• 🔲Pledge & campaign tracking.
• 🔲Multi-currency: Mini uses one currency per church by design.
• 🔲Self-serve signup & subscription billing.

Known Limits for COS Mini (Only restricted to this version)

• Email volume: sending is shared across all deployments (about 100 to 1,000/day). Fine for access codes, notifications, birthday greetings, and system updates; not for bulk mailing.
• Deleted members: a deleted member’s profile is gone permanently (their contributions remain in the church’s financial records, but their Individual Member Statement can no longer be produced).
• Backups: no in-app export; the operator keeps periodic copies of the workbook.
• One currency per church: other-currency gifts are recorded as their converted value.