Double the Donation

Double the Donation is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Double the Donation is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Double the Donation's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Double the Donation hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Double the Donation is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Internal user authentication policies for Double the Donation's staff are outlined in the "Access Control Policy" document, found under "Resources" in this Trust Center. Information about user authentication for the client-facing portal, not Double the Donation’s internal systems, can be found here. Specifically, reference password requirements here and multi-factor authentication functionality here.

Double the Donation clients can delete data from their accounts at any time, directly from the client portal. Double the Donation can also delete customer data in bulk upon request (typically unnecessary, given easy client access to deletion). Double the Donation relies on Azure for data destruction and can only perform logical deletion. Deleted customer data is rendered unreadable or disabled by Azure and the underlying storage areas on the Azure network that were used to store the content are wiped, prior to being reclaimed and overwritten, in accordance with Azure standard policies and deletion timelines. Azure procedures also include a secure decommissioning process conducted prior to disposal of storage media used to provide the Azure services. As part of that process, storage media is degaussed or erased and physically destroyed or disabled in accordance with industry standard practices.

Double the Donation's database and platform are hosted on Microsoft Azure servers in the Virginia location. More information here.

Double the Donation's availability is consistently above 99.99%. Any customer data is 100% backed up to multiple online replicas with additional snapshots and other backups. Double the Donation relies on site24x7 to monitor uptime. Double the Donation also relies on Sentry notifications to broadcast all errors and warnings to senior developers via email and Slack. For the underlying database, Double the Donation logs all queries that take more than 200 milliseconds to execute and uses that data to routinely optimize. Double the Donation also uses Datadog to monitor uptime and alert team members to disruptions. For more information, view our SLA here.

The sole purpose of data sharing with Double the Donation is to increase nonprofit organizations’ employer matching gift revenue and to provide actionable insights on donor behavior. The data points that are expected to be shared from client organizations into their accounts are: - Donor first name - Donor last name - Donor's email address - Transaction ID - Donor's phone number - Donor's employer - Campaign the donor gave to - Donation amount In almost all cases, Double the Donation collects the above data points by utilizing turnkey integrations with donation forms and CRMs. These integrations, configured by each individual client, automatically pass transaction level details into clients’ Double the Donation account once donations are made online or via continuous syncs from a CRM at predetermined intervals. Only identified fields from connected objects and modules will be passed into Double the Donation. Double the Donation does not have access to any additional data from connected systems.