Data Security Policy

This policy describes how Impacturi (operated by Clickonic Ltd) protects the personal data and donor information entrusted to us by our customers. We handle data belonging to charities and their donors, and we take that responsibility seriously.

1. Infrastructure and hosting

• Database: Hosted on Supabase (PostgreSQL). Supabase is SOC 2 Type II certified. Data is encrypted at rest using AES-256.
• Application: Hosted on Vercel. All traffic is served over HTTPS with TLS 1.2 or higher. Vercel is SOC 2 Type II certified.
• Payments: Processed by Stripe. No card numbers or payment details are stored on our infrastructure. Stripe is PCI DSS Level 1 certified.
• AI services: The AI writing assistant uses the OpenAI API. Data sent to OpenAI is used only to generate the requested content and is not used to train models (per OpenAI's API data usage policy).

2. Access control

• Row-level security: Enforced at the database layer on all tables containing customer data. Each charity can only query, insert, update, or delete their own records. This is not application-level logic that could be bypassed; it is enforced by PostgreSQL itself.
• Authentication: Managed by Supabase Auth. Passwords are hashed using bcrypt. Session tokens are short-lived and rotated automatically.
• Admin access: The platform owner does not have routine access to customer data through the application. Direct database access is restricted and used only for maintenance, debugging, or at the customer's request.

3. Data in transit

All data transmitted between users and the platform is encrypted using TLS. This includes browser sessions, API calls, CRM sync connections, and file uploads. We do not support unencrypted HTTP connections.

4. Data at rest

All data stored in the database is encrypted at rest using AES-256, provided by the hosting infrastructure. Uploaded files (logos, photos) are stored in Supabase Storage with the same encryption standards.

5. CRM integration security

When a charity connects an external CRM (such as Beacon or Donorfy), the API credential is encrypted at rest in a dedicated secrets vault, separate from the ordinary application tables. It is decrypted only in memory, only for the duration of that charity's own sync, and is never returned to the browser. Access is restricted to the charity that created it, and that ownership is proved on the server before any operation runs, including disconnection.

We also limit what a connected CRM can expose if something goes wrong upstream. Error responses from a CRM are recorded by status code only, never by content, so a fault at the CRM's end cannot copy supporter records into our logs or our error monitoring. Credentials and personal data are stripped from anything sent to our error-monitoring provider. Every sync is bounded, so no single connection can be used to exhaust the platform.

Disconnecting is immediate and complete: the stored credential is destroyed at the point you disconnect. You can also revoke the key at your CRM at any time, without involving us, and the connection stops working straight away.

6. Backups

Database backups are managed automatically by Supabase. Backups are encrypted and retained according to the hosting provider's backup policy. We do not maintain separate backup infrastructure.

7. Vulnerability management

Since 6 August 2026 our security review runs as an automated job every Monday at 08:00 rather than as a periodic manual exercise. Each run is recorded, and a failure raises an alert the same morning.

• Weekly automated review: every Monday the platform is checked for known vulnerabilities in its dependencies, for correct isolation between customer accounts, for the security headers being live and enforcing, and for the specific safeguards that protect connected CRM credentials. Any failure is alerted and dated.
• Dependency patching: known vulnerabilities in production dependencies are held at zero. The weekly job fails if that is not the case, so a missed patch surfaces within seven days rather than at the next manual review.
• Automated safeguards on every code change: the checks that protect connected CRM credentials and supporter data run as tests, so a future change cannot quietly remove them.
• Independent testing: we have not commissioned a third-party penetration test. We will say so plainly rather than imply otherwise, and we will update this page if that changes.
• Cyber Essentials certification: in progress. Target: Q4 2026.

8. Incident response

We maintain an Incident Response Plan that defines how we detect, respond to, and communicate about security incidents. In the event of a personal data breach, Clickonic (as Processor) will notify the affected charity (as Controller) within 24 hours of discovery. The charity is then responsible for assessing ICO notification requirements within the statutory 72-hour window.

9. Staff and confidentiality

All individuals with access to production systems are bound by confidentiality obligations. Access is granted on a need-to-know basis and reviewed regularly.

10. Third-party certifications

Our infrastructure providers hold the following certifications:

• Supabase: SOC 2 Type II
• Vercel: SOC 2 Type II
• Stripe: PCI DSS Level 1

Impacturi is working towards Cyber Essentials certification. This page will be updated when certification is achieved.

11. Your responsibilities

As a customer, you are responsible for:

• Keeping your login credentials secure and not sharing them
• Ensuring the donor data you upload is accurate and lawfully obtained
• Informing your donors that their data is processed through the Impacturi platform
• Reporting any suspected security issues to us promptly

12. Contact

For security questions, to report a vulnerability, or to request a copy of this policy in PDF format, contact:

Security Team, Clickonic Ltd
security@impacturi.com

Dermot Dennehy, Founder, Clickonic Ltd
security@impacturi.com