Security
A plain-language summary of how customer data is handled. Written for nonprofit boards doing vendor due diligence.
Where data lives
Our main copy of customer data is one SQLite database on our production server, in a US data center. The server also keeps backup copies of that database, and encrypted backup copies are in Google Drive. The copies of the database on our staff's computers, which they use to test changes, hold only state rules, their sources and our change log, and no data about a person or an organization. A test that needs customer data runs on a copy on our production server, which we delete on the same schedule as our backups. Stripe keeps payment data, and our mail provider keeps the email we send and receive. Our staff read support email in a Google mailbox. The AI assistants our staff use, Anthropic's Claude and xAI's Grok, can read the data in our systems while they help us. We do not copy customer data to third-party analytics, marketing, or advertising platforms. The Privacy Policy lists each outside service that receives or keeps customer data.
Encryption
charityfile.com serves pages only over HTTPS: our reverse proxy answers a plain HTTP request with a redirect to HTTPS, and tells browsers to use HTTPS next time. Authentication tokens travel as HTTP-only cookies over HTTPS. We send email to our mail provider over an encrypted connection; email between mail servers is not always encrypted. Nightly backups sent offsite are encrypted with GPG AES-256. Plain copies stay on the server for up to 30 days for restore; a few pre-deployment snapshots kept for rollback can be older.
Authentication
Sign-in is via emailed magic link, passkey, or Google. We do not store passwords. A sign-in link works one time, for 1 hour. The browser that opens the link is the one that signs in, so keep your mailbox safe. A magic link stores your email. A passkey stores its public key and credential ID. Google sign-in stores the account ID and your email.
What we collect
For sign-in: your email; a passkey public key and credential ID; the Google account ID. For compliance tracking: facts about your organization, such as its EIN, name, address, revenue, fiscal year, state registrations and your answers. When you check a box to accept our Terms, we record your IP address and browser, and our web server logs them with each request. We do not store card numbers or bank account numbers: Stripe takes online payments. For each payment, by Stripe or by invoice, we keep the date, the amount and the reference, and for the refund of a whole payment its date and reference; Stripe or Wise keeps the record of a partial refund. We keep the Stripe customer ID. The Privacy Policy gives the full list.
Reporting a vulnerability
If you believe you’ve found a security issue, please email support@charityfile.com with details. Our target is to reply within 2 business days. A business day is Monday to Friday. Please do not test against live customer data.