Security & trust
Your donor data, and exactly how we look after it.
Encryption at every layer, an EU-hosted database, and plain-English policies you can hand to your board. Including, on this page, the things we have not done yet.
Encrypted everywhere
All data in transit over TLS 1.3. All data at rest encrypted at the database layer. CRM integration credentials stored with encrypted key management.
EU hosting, with named exceptions
Your database is Postgres on Supabase Pro in EU-west-1 (Ireland), so donor records are stored in the EU and page rendering makes no cross-Atlantic round trip. Three processors are US-based and are named in our privacy policy: OpenAI and Anthropic, used to draft impact copy, and Resend, used to send email.
Row-level security
Every charity sees only their own data, enforced at the database rather than in the application, so an ordinary bug in our code cannot cross from one charity to another. Some server routes use an elevated key that steps around that check, because the database check alone cannot do their job. Among them are scheduled jobs that run with nobody signed in, and public endpoints that take a comment, a click or an enquiry from a visitor who has no account. On those routes it is our own code, not the database, that keeps one charity's data apart from another's. Tenant isolation is re-tested every week against the live database using the public key that ships in every visitor's browser, exactly as an attacker would.
Multi-factor auth
TOTP-based 2FA on platform admin and the production deploy chain. Domain lock on the registrar. FileVault on engineering laptops. Not yet everywhere: four delivery and AI vendor accounts still need it, and that work is outstanding rather than done.
Daily backups
Daily automated database backups with eight-day retention, and a weekly copy of uploaded files to separate storage. Restore testing: not yet carried out. We have not restored a backup and verified it, so we do not claim a proven recovery time. Scheduled for Q4 2026.
Need a deeper assurance pack?
Larger charities and corporates often ask for a vendor questionnaire or sub-processor list. Email security@impacturi.com and Dermot Dennehy (Founder, Clickonic Ltd) will respond personally.
Book a 20-minute demo