Double the Donation

Double the Donation hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@doublethedonation.com or via a /security page (Double the Donation lists a security contact).

Double the Donation lists 4 subprocessors on its trust center, including Microsoft Azure, GitHub, Vanta, SendGrid. Buyers use this for fourth-party risk review.

Double the Donation hosts on Azure, and handles Employee personally identifiable information, Credit card information, Personal health information, Donation data relevant for matching gift communications. Data residency details are on its trust center.

Double the Donation's trust center is at https://security.doublethedonation.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Internal user authentication policies for Double the Donation's staff are outlined in the "Access Control Policy" document, found under "Resources" in this Trust Center. Information about user authentication for the client-facing portal, not Double the Donation’s internal systems, can be found here. Specifically, reference password requirements here and multi-factor authentication functionality here.

Double the Donation clients can delete data from their accounts at any time, directly from the client portal. Double the Donation can also delete customer data in bulk upon request (typically unnecessary, given easy client access to deletion). Double the Donation relies on Azure for data destruction and can only perform logical deletion. Deleted customer data is rendered unreadable or disabled by Azure and the underlying storage areas on the Azure network that were used to store the content are wiped, prior to being reclaimed and overwritten, in accordance with Azure standard policies and deletion timelines. Azure procedures also include a secure decommissioning process conducted prior to disposal of storage media used to provide the Azure services. As part of that process, storage media is degaussed or erased and physically destroyed or disabled in accordance with industry standard practices.

Double the Donation's database and platform are hosted on Microsoft Azure servers in the Virginia location. More information here.

Double the Donation's availability is consistently above 99.99%. Any customer data is 100% backed up to multiple online replicas with additional snapshots and other backups. Double the Donation relies on site24x7 to monitor uptime. Double the Donation also relies on Sentry notifications to broadcast all errors and warnings to senior developers via email and Slack. For the underlying database, Double the Donation logs all queries that take more than 200 milliseconds to execute and uses that data to routinely optimize. Double the Donation also uses Datadog to monitor uptime and alert team members to disruptions. For more information, view our SLA here.

The sole purpose of data sharing with Double the Donation is to increase nonprofit organizations’ employer matching gift revenue and to provide actionable insights on donor behavior. The data points that are expected to be shared from client organizations into their accounts are: - Donor first name - Donor last name - Donor's email address - Transaction ID - Donor's phone number - Donor's employer - Campaign the donor gave to - Donation amount In almost all cases, Double the Donation collects the above data points by utilizing turnkey integrations with donation forms and CRMs. These integrations, configured by each individual client, automatically pass transaction level details into clients’ Double the Donation account once donations are made online or via continuous syncs from a CRM at predetermined intervals. Only identified fields from connected objects and modules will be passed into Double the Donation. Double the Donation does not have access to any additional data from connected systems.

Yes! Double the Donation updates the Subprocessor list within 30 days of adoption of any new subprocessor. You can view an up-to-date subrocessor list directly within this Trust Center.

To the best of our knowledge, Double the Donation is compliant with GDPR standards. Learn more here.

This Trust Center is the hub for our most commonly asked security questions and requested documentation. For any information not contained here, we recommend referencing our full documentation: Double the Donation Information Technology and Security Policies and Procedures