How your church's records are kept separate
What actually stops another church reading yours.
Every read and write passes through row level security in Postgres. A query for another church's records is refused by the database, not hidden by the page. Somebody bypassing the interface entirely would still get nothing.
The same mechanism enforces roles inside your church. A class leader asking the database directly for the giving records is refused in exactly the same way as one clicking a menu that is not there.
Did this answer your question?
If not, tell us what you were trying to do. A real person replies within a day, and we write the missing article so the next church finds it.