The Free JW Congregation Management System

Everything Your JW Congregation Needs

How It Works

Enterprise-Grade Security — Built In

hubport.cloud uses the same security technologies trusted by banks, governments, and Fortune 500 companies. Your congregation's data is protected by industry-leading open-source tools — not homegrown solutions.

Keycloak — Identity & Access Management

Keycloak is an enterprise-grade identity provider used by Red Hat, the German government, and thousands of organizations worldwide. It handles user authentication, role-based access control, and multi-factor authentication (MFA). Each congregation gets its own isolated Keycloak realm — no shared accounts, no shared data.

HashiCorp Vault — Secrets Management

Vault is the industry standard for managing sensitive credentials, used by companies like Stripe, Adobe, and Cisco. All secrets — database passwords, API keys, encryption keys — are stored in Vault's encrypted storage. Secrets are never written to disk in plaintext and are rotated automatically.

Database Encryption — Personal Data Protection

All personal data (names, contact information, addresses) is encrypted at the application level before being stored in the database. The encryption key is generated during setup and stored exclusively in Vault. Even if someone gains direct access to the database, personal data remains unreadable without the Vault-stored key.

Passkey-First Authentication — Phishing-Proof Login

Every user must set up a passkey (fingerprint, Face ID, or security key) or an authenticator app before accessing the platform. Passkeys are the most secure way to log in — they can't be phished, guessed, or stolen in a data breach. Combined with strong password policies and brute force protection, your congregation's accounts are protected by the same standards used by banks and government agencies.

End-to-End Encrypted Chat — Built-In Congregation Messaging

Every hub includes a self-hosted chat system powered by the Matrix protocol. All messages are end-to-end encrypted — only the sender and recipients can read them. Auto-created channels for service groups, duty teams, and elder-only discussions. Single sign-on means one login for everything. Unlike WhatsApp or Telegram, your messages stay on YOUR server.

Cloudflare Tunnel — Zero-Exposure Networking

Your server is never directly exposed to the internet. Cloudflare Tunnel creates an encrypted outbound-only connection from your server to Cloudflare's global network. No open ports, no public IP needed, no DDoS attack surface. Access is protected by Cloudflare Zero Trust — users authenticate in their browser before any traffic reaches your server.

Transparent Security — Live Scan Results

We believe security should be verifiable, not just claimed. Our code is continuously scanned for vulnerabilities by independent tools. The results are public — click any card to see the full report.

GitHub CodeQL Static analysis — finds SQL injection, XSS, and code quality issues Snyk Security Dependency scanning — detects known vulnerabilities in npm packages Dependabot Automated alerts — monitors dependencies for new CVEs

Why Register?

You can always self-host hubport.cloud on your own domain without registering. But registering gives you these benefits:

• ✓ Automatic tunnel setup — your congregation gets a secure subdomain (e.g., penzberg-north.hubport.cloud) with encrypted access, no networking knowledge needed
• ✓ Share between congregations — exchange territory data and public talk schedules with other registered congregations, with mutual approval
• ✓ Update notifications — get notified when new versions with improvements and security fixes are available
• ✓ Community support — access to the registered congregation community for help and best practices