Security and your data

Card numbers

DonorFinch never sees, stores or transmits card or bank numbers. Stripe collects them in the donor's browser inside its own secure frame; we receive only a token and the last four digits. This keeps your organization out of PCI scope beyond the simplest self-assessment, and means a problem with your website can't expose card data.

Where your data lives

In a managed PostgreSQL database hosted in the United States, encrypted at rest and in transit, with continuous backups and point-in-time recovery. Receipts and statement PDFs are stored in private object storage, served through signed links.

Tenant isolation

Each organization's data is separated at the database level: every query runs with your organization's identity set, and the database itself refuses to return rows that belong to anyone else. Application bugs can't cross that line. The same mechanism applies to our support tooling and to the AI assistants we're adding; they can read your organization's data only when a signed-in member of your organization is asking.

Who at DonorFinch can see your data

A small number of operators can look at an organization's records to resolve a support ticket. Those reads are logged. We don't sell data, don't share donor lists, and don't use your donors' information for anything but running your account.

Sign-in security

Passwordless email links (15-minute, single-use), 30-day sessions, and an audit log of changes. See Signing in with email links. Protect the email accounts your team uses with two-factor authentication.

Donor privacy

Donors can view their own data in their portal and request corrections. Donors never see other donors or other organizations. Emails to donors are sent only for receipts, statements, recurring-plan notices and personal thank-yous your team chooses to send.

Getting your data out

Your donors and giving history are exportable as CSV from Reports: the Donor list report (contact details, lifetime giving, tags) and the Gift detail report (every gift with fund, campaign, method, fees and receipt number). Receipt PDFs can be downloaded individually. If you need a different cut of your data when leaving, ask us and we'll produce it. There's no lock-in and no fee to leave.

Deleting data

Donors are archived rather than deleted, so your financial records stay intact. To close an organization entirely, email support@donorfinch.com from an Owner's address and we'll walk you through export and deletion.

Reporting a security issue

Email support@donorfinch.com with "Security" in the subject. We read it the same day.