Security
How we protect your information when you give, subscribe, or contact us.
Your card never touches us
Card numbers, expiry dates, and security codes go directly to our regulated payment providers. They never pass through or stay on our servers.
One-way cryptography
Staff passwords are stored as bcrypt hashes and login sessions as SHA-256 hashes. Hashes cannot be reversed, so the original secrets cannot be recovered from our database, even by us. If you forget your password, we email a short-lived one-time code so you can set a new one. The old password is never recovered.
Anonymous means anonymous
Gifts marked anonymous are excluded from every listing that names donors. No public page on this site shows donor names at all.
Private even when public
If you allow your name to appear, only the name appears. Contact details are used solely for receipts and legally required records. We never sell or share personal information.
Encrypted in transit and at rest
All traffic runs over encrypted HTTPS. Staff access is limited to individual accounts, and analytics data older than our retention window is purged.