Email Services Support Policy

Effective Date: 18 March 2024 

1. General Terms of Service

1.1. MyChurchIT provides email services primarily through Microsoft 365 in compliance with South African laws and established cybersecurity best practices. 

1.2. Users must adhere to the terms of Microsoft 365’s Acceptable Use Policy and any applicable South African regulations regarding electronic communications and data protection. 

1.3. Users are responsible for maintaining the confidentiality of their email credentials and are strictly prohibited from sharing them with others. MyChurchIT does not store or have access to user passwords. 

1.4. Users are responsible for backing up their own emails. MyChurchIT relies on the standard Microsoft Online Backup service included with Microsoft 365 Business Basic and does not provide additional backup or recovery services. This includes scenarios such as accidental deletion, device theft, hardware failure, or data loss due to local device issues. 

1.5 Users are defined by clients and partners of MyChurchIT, their staff, volunteers and representatives (authorised).  

2. Prohibited Use 

2.1. Users may not use MyChurchIT’s email services for any illegal activities, including but not limited to: 

• Distribution of illegal content.
• Sending spam, phishing emails, or engaging in fraudulent activities.
• Hosting or distributing malicious software.
• Any action that violates South African laws such as POPIA (Protection of Personal Information Act) and the Cybercrimes Act.

2.2. If an account is found to be engaged in prohibited activities, MyChurchIT reserves the right to suspend or terminate the account without prior notice. Users are required to take corrective action before a review can be initiated. The responsibility to address and rectify the issue lies with the client, including their staff, volunteers, and contractors. If there is a dispute regarding whether an activity is prohibited, it may be assessed by a third party, law enforcement, or MyChurchIT’s vendors as appropriate. 

3. Cyber Security & Account Compromise

3.1. To protect the integrity of our services, MyChurchIT enforces Multi-Factor Authentication (MFA) for all new accounts and password resets. We reserve the right to enforce MFA on existing accounts deemed high risk. 

3.2. If an account is suspected of being compromised, it will be temporarily disabled to prevent further risk. Restoration of services will be contingent on security validation. 

3.3. While MyChurchIT does not guarantee recovery of compromised accounts or lost emails due to breaches caused by weak passwords or user negligence, best efforts will be made to assist users in mitigating the impact and securing their accounts. In the case a restore is requested, audit reporting, insurance reporting or other data recovery methods are needed, MyChurchIT labour costs will apply. A client may be to claim against their insurance policies if the policy allows it and with their limits. 

3.4. Payment obligations remain valid even if a user’s account is suspended due to security concerns or policy violations. 

4. Support Scope & Responsibilities 

4.1. MyChurchIT provides support for email system availability and issues related to Microsoft 365 services under the standard offering. We rely on Microsoft for system uptime and will engage with Microsoft on behalf of clients for tenant-level support when necessary. 

4.2. Desktop support, troubleshooting of individual devices, or end-user training is available as an additional service. Clients who require these services can access them through our paid desktop support, managed IT services, or remote support offerings at the applicable billable rate. 

4.3 Email Delivery and Reputation Management – Email delivery is influenced by the reputation of the sending server, provider, and domain. If the reputation of MyChurchIT’s infrastructure is negatively impacted—such as being blacklisted due to policy violations, spam complaints, or abuse—MyChurchIT will take immediate and decisive action to protect its servers, domains, and relationships with providers. This may include suspending accounts, restricting outbound emails, or requiring corrective actions from affected clients. 

4.4. Users must ensure their devices meet minimum security and software standards, including: 

• Running a supported operating system (e.g., latest macOS, Windows versions under active vendor support). For more details, refer to the official vendor support pages:

o Apple macOS Support 

o Microsoft Windows Support 

o Microsoft Office Support 

o Google Android Support 

o Apple iOS/iPadOS Support 

• Having up-to-date security patches and antivirus/malware protection.
• Not being infected with malware or other security threats.

4.5 MyChurchIT supports Microsoft Outlook as the primary email client. Microsoft provides a list of supported clients for Exchange Online, but functionality may be limited in third-party applications. Users experiencing issues with unsupported clients should seek support from the software vendor. If their client is not functioning correctly, they can use Outlook or access email via Outlook Web App as an alternative. Refer to Microsoft’s Exchange Online Client Support for details. 

4.6. Users can also access email via the web using Outlook Web App, which provides full functionality across supported browsers. 

4.7. Users must ensure that contacts are saved in their Microsoft 365 account rather than relying on local storage or ‘Quick Save’ features, which are not backed up or synchronised. 

4.8. If there are no known service outages and Outlook Web App is working as expected, any email issues are likely related to the user’s device or network. In such cases, troubleshooting should be done on the client side, as the email system itself remains operational. Users are responsible for resolving local device or network-related problems. 

4.9. If a user’s device is compromised or found to have security vulnerabilities, MyChurchIT reserves the right to deny support until the issue is resolved. 

4.10. Recipient-Side Email Issues – Many email delivery issues originate on the recipient’s side, such as spam filtering, mailbox restrictions, or email rejection. While MyChurchIT can assist with tracing, resolution often depends on the recipient’s IT policies and email provider settings. 

4.11 Email Tracing and Log Requests – MyChurchIT provides limited support for email traces and log investigations. If an issue requires extensive analysis or falls outside normal operational support, such requests may be subject to billable support fees.  

4.12 DNS and Email Security Settings – Where MyChurchIT manages DNS, SPF records are configured by default to improve email deliverability. Additional protections such as DKIM and DMARC setup are available at an additional cost. These configurations enhance security and reduce the risk of spoofing and phishing attacks. 

4.13 Users must adhere to content restrictions when using email services, including compliance with anti-spam regulations and ethical communication practices. MyChurchIT reserves the right to suspend an email account is a violation is reported. 

4.13 MyChurchIT will cooperate with valid law enforcement requests and will report to law enforcement when illegal activity is suspected.  

4.14 Where Microsoft high risk usage is detected, MyChurchIT may conduct a usage audit provided by Microsoft Purview, this may include placing a mailbox in legal hold, blocking access and restricting access pending any investigation. A client will still be responsible for any subscription commitments and reasonable costs.  

 5. Bulk Email Services 

5.1. Microsoft 365 Bulk Email 

5.2. When an email address is used for bulk email services under the Microsoft 365 email subscription service (SKU), support is limited and subject to Microsoft Office 365 rate limits. For more information on these limits, refer to Microsoft’s Exchange Online sending limits.  

5.3. MyChurchIT Church Management System Bulk Email  

5.4. Email services provided through the MyChurchIT Church Management System are separate and fall outside the scope of this document. Email services provided through the MyChurchIT Church Management System fall outside the scope of this document, as it specifically applies to individual email accounts under the email subscription service (SKU). 

5.4. If a client makes use of an alias from a domain managed by MyChurchIT for sending bulk email, it is for exclusive use within the MyChurchIT Church Management System. This service is only available to active clients in good standing. 

5.5 Email services provided through the MyChurchIT Church Management System use outbound mail servers outside of the Microsoft 365 ecosystem. Domains used for sending bulk email must include SPF DNS record and MyChurchIT will not provide support when a domain is used with SPF. An SPF (Sender Policy Framework) record is a DNS record that specifies which mail servers are authorised to send emails on behalf an email domain, which prevents unauthorised use and email delivery (acceptance). 

 5. Password Policy & Security 

6.1. Passwords act as security tokens. MyChurchIT does not store or manage user passwords. 

6.2. Users must create strong, unique passwords. Simple or commonly used passwords increase security risks and may lead to account compromise. 

6.3. Weak security practices can impact the reputation of both MyChurchIT and the organisations it serves. Users must take responsibility for safeguarding their accounts. 

6.4. Microsoft Business Basic is the standard offering provided under this policy. Security protections, such as system-wide threat prevention, authentication measures, and compliance monitoring, are managed by Microsoft as part of their cloud services. 

6.5. Advanced security features beyond the standard Microsoft Business Basic offering are available at additional cost. These may require additional licenses and consultation for implementation. 

6.6 It is imperative if someone feels like their password or access is compromised to immediately contact MyChurchIT to restrict access, and limit damage. Reporting security concerns is a responsible action and is strongly encouraged. This may include being a victim to a phishing attack.  

For further information or assistance, please contact MyChurchIT via the Contact Us section on the MyChurchIT Website.