Security
How your donors' records are kept
DonorCARE holds an organization's donations, receipts and e-Invoice history. This is what protects them, said plainly enough for a committee to check.
- RM 0
- Donor money held by DonorCARE
- 0
- Card numbers stored
- 5
- Staff roles, set by your Owner
- AES-256
- On the gateway and LHDN keys you connect
Whose data it is
Each organization sees its own records, and only its own
Donors, donations, campaigns and receipts belong to one organization. A staff request is checked against the signed-in person's organization and role before anything is read or changed, and public pages show only what an organization has published.
- An organization never sees what a donor gave to another organization.
- A donor's tax details are held separately for each organization they give to.
Who can do what
Five roles for the people in your office
Owner, Admin, Finance, Member and Viewer each start with their own set of what they can see and do, and your Owner can change that set. Everyone signs in to their own account, so a change is tied to a person.
- Sensitive actions, such as voiding a donation, can wait for a second person's approval.
- Donors sign in with a one-time code sent to their email and see only their own gifts.
- When DonorCARE staff sign in to your organization to help you, it is recorded in our own audit log.
The front door
Sign-in and public forms are guarded
Sign-in attempts and public endpoints are rate limited, and the public forms most open to abuse carry a bot check. A one-time sign-in code expires shortly after it is sent.
Keys and connections
Encrypted on the way and where it rests
Traffic to DonorCARE travels over TLS and the database is encrypted at rest. The keys you connect for your payment gateway and for LHDN e-Invoicing are encrypted again, field by field, before they are stored.
- Webhook signing secrets are encrypted the same way.
- Outgoing webhooks are signed, so your system can check that a message came from DonorCARE.
The money
Gifts settle to your account, never ours
Online gifts go through your organization's own payment gateway account. DonorCARE records the gift and issues the receipt. It does not hold donor money and does not store card numbers.
- A monthly gift is charged through a token your gateway issues. The card itself stays with the gateway.
- The only payment DonorCARE takes on its own account is your plan fee.
The record
A timeline on every donation and campaign
Each donation and each campaign carries its own timeline: what changed, who changed it and when. e-Invoice submissions and changes to your team's access are recorded as well.
- Your team reads a record's timeline on the record itself.
- Anyone holding a receipt can check it on a public verification page.
The AI Copilot
It proposes. An admin approves
The Copilot reads only the organization that asked. Anything that would change a record waits as a proposal until one of your admins approves it. Under our AI provider's terms, your prompts and your data are not used to train its models.
The donor's side
Donors keep a say over their own account
A donor can see their own giving history, correct their details and delete their account. Receipts an organization has already issued stay with that organization, because the law asks it to keep them.
Your way out
Your data leaves with you
Donations, donors and receipts can be exported from Finance. The data processing terms set out what we do with personal data on your behalf under the PDPA, and what happens to it when you leave.
Read the detail
What committees ask us
Who owns the donor records we keep in DonorCARE?
Your organization does. Under the data processing terms your organization is the data user and DonorCARE is its processor: we handle donor data on your instructions, to run the features you switch on.
Can another organization on DonorCARE see our donors?
No. An organization sees only its own donors and its own donations. A donor who gives to two organizations has a separate record with each, and neither organization sees the other's.
Can DonorCARE staff see our records?
Yes, when supporting you. DonorCARE support staff can open an organization's account to investigate a problem you report, and each time they do it is recorded in our own audit log. The data processing terms limit what we may do with what we see.
Do you store card numbers or hold our donations?
No to both. Card and bank details are entered with your payment gateway, and gifts settle to your organization's own gateway account. DonorCARE keeps the record of the gift and the receipt.
Is there two-factor authentication?
Not yet. Staff sign in with a password or a one-time code sent to their email, and donors with a one-time code. Two-factor authentication and passkeys are not available today, and we would rather say so than imply otherwise.
Which other companies handle our data?
The Subprocessors page lists every provider, what it does for us and where it operates: the database, hosting, file storage, email delivery, payment gateway, e-Invoice submission and the AI Copilot.
What happens if there is a breach?
Under the data processing terms we notify the affected organization without undue delay, and in any event within 72 hours of becoming aware of the incident, and we help with the organization's own investigation.
What happens to our data if we leave?
You can export it. The Subscription Terms and the data processing terms set out the export window after an account ends, the deletion that follows, and the donation and receipt records the Income Tax Act requires to be retained.
Our committee needs a security questionnaire answered. Who do we ask?
Write to [email protected]. A person reads every message, and the same address takes reports of a security problem.
Found a security problem?
Write to [email protected]. A person reads every report. For a security questionnaire or an agreement your committee needs signed, write to the same address.