Givecloud

Givecloud hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@givecloud.com or via a /security page (Givecloud lists a security contact).

Givecloud lists 18 subprocessors on its trust center, including Certn, Cloudflare, Google Cloud Platform, Intercom, BugSnag. Buyers use this for fourth-party risk review.

Givecloud hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Givecloud's trust center is at https://trust.givecloud.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Disk encryption is enforced on employee devices, at-rest in backups and cloud storage, and within running databases. No customer options exist. Infrastructure encryption uses AES-256 and a FIPS 140-2 validated encryption module. More detail on encryption at rest in GCP in their docs if needed: https://cloud.google.com/docs/security/encryption/default-encryption

Givecloud's primary servers and data location is Google's us-east1 availability region (South Carolina) with backups in us-east4 (Virginia). We also offer availability in northamerica-northeast1 (Montréal) as a Low CO2 option. Alternative data storage locations can be arranged.

Yes, a simple email to infosec@givecloud.com can be used to report security vulnerabilities, which is published on this Trust page at https://trust.givecloud.com.

Yes. 7 days for P0 security vulnerabilities, 14 days for P1.

Yes—with important context. While the California Consumer Privacy Act (CCPA) primarily applies to U.S.-based entities that meet specific thresholds, Givecloud is a Canadian-owned company that does not meet the applicability criteria outlined in the law. Specifically: CCPA Does Not Legally Apply to Givecloud Because: - Givecloud is not a U.S. business and does not operate a U.S. subsidiary. - Givecloud does not generate more than $25 million in annual revenue. - Givecloud does not sell personal information. We are firmly committed to privacy-first practices and donor trust. - Givecloud processes personal data exclusively on behalf of its nonprofit clients, in a role consistent with a data processor or service provider. Voluntary Alignment with CCPA Principles Even though CCPA doesn’t legally apply, Givecloud voluntarily aligns with its spirit to help nonprofits meet donor expectations and uphold best practices in data privacy: - Donors can view and manage their personal information via the Donor Portal. - Donors can request their data be removed, and Givecloud provides nonprofits with tools to fulfill such requests securely. - Givecloud does not and will never sell, trade, or monetize donor data in any way. - Givecloud is SOC 2 Type II and PCI-DSS compliant, ensuring rigorous data protection standards. What This Means for Your Organization If your nonprofit collects personal information from California residents: - You are the "business" or "data controller" under CCPA. - Givecloud acts as your "service provider" and supports your compliance efforts, even though we’re not bound by the same legal requirements. Givecloud is committed to upholding Trustraising values, which includes handling donor data with the utmost care, transparency, and integrity—no matter where your donors live.

Givecloud is not currently HIPAA compliant. While Givecloud follows stringent industry security protocols—such as SOC 2 Type II and PCI DSS compliance to protect donor data and payment processing, and holds subprocessors to the same standards—it is not designed for managing or storing Protected Health Information (PHI) as defined by HIPAA. Givecloud is purpose-built to support the fundraising and donor stewardship needs of nonprofits. Our platform processes donations, memberships, event registrations, and other giving-related experiences—but it is not intended for use cases involving sensitive medical data or patient health records. However, if your organization operates in the healthcare or research space, it’s important to know: * All donation data is securely encrypted and stored according to modern best practices. * Givecloud supports multi-currency, secure payment gateways, and CRM integrations (like Salesforce and DonorPerfect) with high standards of security and data governance. * We help you *build trust with donors through transparent, emotionally compelling giving experiences* that are easy, secure, and compliant with financial regulations. If HIPAA compliance is a strict requirement for your organization’s use case, such as processing donations tied to specific patient data, we recommend speaking to our team to evaluate the best solution for your goals.