GraceFlow CMS is a modern, modular, secure, and open-source Church Management System built for churches and Christian ministries globally. Designed to streamline administrative workflow without bloat or operational friction, GraceFlow CMS empowers leadership to shepherd their congregation with clarity and efficiency.
- 👥 Member & Family Management: Complete directory for individual members, family structures, emergency contacts, baptism status, and department affiliations.
- 📋 Attendance Tracking: Record, monitor, and analyze attendance across Sunday services, mid-week meetings, and special ministry events.
- 🏛️ Department & Ministry Coordination: Organize church units, team rosters, leadership assignments, and member roles.
- 🎂 Birthday & Anniversary Reminders: Automated tracking and celebratory notifications for member birthdays and milestones.
- 📖 Sermon & Bible Study Library: Store, catalogue, and publish sermon archives, audio notes, and weekly Bible study outlines.
- ✉️ Multi-Channel Communication: Reach congregation members via integrated Email, Bulk SMS, and WhatsApp broadcast templates.
- 🔒 Role-Based Audit Logging: Enterprise-grade security audit logs capturing user actions, IP addresses, and device signatures.
- 🌐 Public Self-Registration Portal: Dedicated lightweight public portal allowing new visitors and members to register seamlessly.
- Framework: Next.js 14 (App Router, Server Actions, Middleware)
- Language: TypeScript
- Database: MongoDB with Mongoose ORM
- Styling: TailwindCSS & Lucide Icons
- Authentication: Custom HTTP-only Cookie JWT Authentication with Role-Based Access Control (RBAC)
- File Storage: Vercel Blob Storage
- Messaging: Nodemailer (SMTP), Bulk SMS API, and WhatsApp Integration
-
Clone the Repository
git clone https://github.com/your-org/graceflow-cms.git cd graceflow-cms -
Install Dependencies
npm install
-
Configure Environment Variables Copy
.env.exampleto.env.localand set your credentials:cp .env.example .env.local
Ensure you set
JWT_SECRETand yourMONGODB_URI. -
Initialize Database & Seed (Optional)
npm run seed
-
Run the Development Server
npm run dev
Open http://localhost:3000 in your browser.
- JWT Auth & HTTP-Only Cookies: Prevents XSS token theft by storing session state strictly in HTTP-Only cookies.
- Sliding-Window Rate Limiting: Protects sensitive endpoints (Login, Uploads, Setup) against brute-force attacks.
- Strict Security Headers: Pre-configured with
X-Frame-Options: DENY,X-Content-Type-Options: nosniff,Strict-Transport-Security, and restrictivePermissions-Policy. - Sanitized Upload Handler: File upload endpoints enforce strict MIME type matching, extension verification, and random filename hashing.
- Zero Raw Stack Leaks: Production error handling ensures internal database exceptions are never leaked to external clients.
We welcome global open-source contributions! Please review our CONTRIBUTING.md guide for instructions on submitting bug fixes, feature requests, and code enhancements.
GraceFlow CMS is licensed under the MIT License. Free for personal, commercial, and ministry use worldwide.