Security, privacy, and platform practices.

Our Approach

DonorCharm provides fundraising and engagement technology for campaigns, donations, events, communications, and related activities. Protecting customer and donor information is an important part of operating the platform. This overview explains current platform practices at a high level and is intended to support informed customer review.

Security and Access

Administrative and customer functionality uses authenticated sessions and application role and permission mechanisms. The platform applies authorization and validation controls in multiple administrative and tenant-facing workflows.

Some donor-facing pages, enrollment experiences, and service-provider callbacks are intentionally accessible without a customer account so that those workflows can operate.

Customers are responsible for limiting accounts to authorized users, protecting credentials, selecting appropriate administrators, and promptly notifying DonorCharm of suspected unauthorized access.

Application Security

The application uses server-side request validation, framework security features, authorization policies in selected workflows, dependency lockfiles, and provider-signature verification in selected integrations.

DonorCharm reviews application security and architecture as part of ongoing maintenance and modernization.

Security controls are evaluated and improved based on risk, platform changes, customer needs, and available assurance activities. Specific technical or operational details may be shared with customers when appropriate and subject to confidentiality restrictions.

Payment Processing

DonorCharm uses Stripe for payment-processing functionality. Payment-card information is handled through Stripe’s payment interfaces, and the DonorCharm application retains limited transaction information needed to associate payments with donations, purchases, campaigns, fees, refunds, and receipts.

The application includes verification of Stripe webhook signatures before processing supported Stripe events.

Communications

DonorCharm integrates with Twilio for SMS and SendGrid for email. These integrations support campaign communications, delivery records, and communication preferences.

The platform maintains SMS opt-out records and recognizes common opt-out and restart keywords in supported messaging workflows.

Customer organizations are responsible for lawful message instructions, recipient consent, campaign content, and compliance obligations associated with communications they initiate.

Data Protection and Privacy

The platform processes information needed for fundraising, transactions, communications, fulfillment, administration, and support.

This may include donor contact information, campaign participation, donation or purchase details, message content, question responses, and user-submitted content when enabled by a campaign.

DonorCharm’s Privacy Policy describes the categories of information processed, purposes, disclosures, retention approach, and request process. Customer organizations may separately determine how information is collected and used through their campaigns.

Infrastructure and Reliability

DonorCharm operates a web application supported by database, cache, file-storage, and third-party service infrastructure.

Availability can be affected by maintenance, provider incidents, network conditions, and other operational events. Unless a written agreement states otherwise, DonorCharm does not publish a guaranteed service level in this overview.

Third-Party Providers

Current platform integrations include Stripe for payments, Twilio for SMS, SendGrid for email, and hosting or infrastructure providers.

Additional providers may support storage, monitoring, support, backups, or other operations. A customer may request available subprocessor or provider information appropriate to its review.

Independent Assurance Status

DonorCharm is evaluating security frameworks and independent assurance activities as part of its security roadmap.

Customers may request available security documentation and current assurance status.

Shared Responsibility

Security and privacy responsibilities are shared among DonorCharm, customer organizations, users, and service providers.

Customers should configure campaigns appropriately, restrict administrative access, provide lawful data and communications instructions, review campaign content, and maintain their own policies and notices.

DonorCharm is responsible for the controls and commitments allocated to it under applicable agreements.

Security Documentation Requests

Customers and prospective customers may send security questionnaires or request available security documentation at hello@donorcharm.org.

DonorCharm will provide information appropriate to the request, the relationship, and applicable confidentiality or disclosure restrictions.

Report a Security Concern

Security concerns relating to DonorCharm may be reported to hello@donorcharm.org.

Please provide a clear description, relevant dates, affected pages or accounts, and contact information for follow-up.

Report a Security Concern →

Document Control