Nothing is more significant to us than the goodwill of donors and vitality of the nonprofits they support. That is why we spare no effort to ensure data privacy in accordance with the law, best practices and what is right.
First and foremost, we and our nonprofit members never directly see or store any donor payment information. (Saved payment details are captured by and stored securely in a payment processor without passing through our servers. That data can nevertheless be deleted upon request.)
With any data we do collect and retain, we take every reasonable action to protect against its loss or misuse, both in transit and at rest. While in transit, it is protected using end-to-end encryption and SSL protected web pages (see more below). At rest, it resides in encrypted databases. Most importantly, we only store data for as long as required, and, critically, we will never sell, rent or lease it to third parties.
For more about individual nonprofits’ privacy policies and how they use and protect personal data, contact the nonprofits directly. For more about some of our partners, see More About Our Partners’ Security below.
In terms of hardware, our website and technology are hosted by Amazon Web Services (see more below), a robust and reliable platform that ensures continuous operations, round-the-clock support and top-quality security, including firewalls, encryption, monitoring, penetration testing and more. Learn more about AWS security.
All our web-based tools and widgets are hosted on pages with a hyperlink starting “HTTPS," meaning the page is completely secure. Even when our widgets are embedded on pages that do not include “HTTPS,” our widgets are still secure.
“HTTPS” stands for Hypertext Transfer Protocol Secure, which is a combination of the Hypertext Transfer Protocol (HTTP) – a basic mechanism that allows for data exchange on the web – and an extra Secure Socket Layer (SSL)/Transport Layer Security (TLS) protocol. TLS is an authentication and security process widely used by web browsers and servers. SSL allows for the transfer of encrypted data.
More specifically, our data in transit is TLS-protected through Amazon Cloudfront, which connects to our servers securely via SSL/TLS, and Heroku, which encrypts data from its server to its Postgres database using TLS.
PCI compliance refers to adherence to the Payment Card Industry Data Security Standard (PCI DSS), a global security standard for account data protection. Compliance involves conformity with numerous security requirements, such as quarterly network scans and annual compliance assessments with stringent validation requirements. Visit the PCI Security Standards Council for more information.
Stripe and PayPal, two industry-leading payment processors trusted by thousands of companies and nonprofits, are what we use to process donations made using Give Lively's fundraising technology. Stripe and PayPal are PCI Level 1 compliant, which means they maintain the highest level of data security when it comes to protecting payment information. Learn more about Stripe’s PCI compliance and PayPal’s PCI compliance.
System and Organization Controls (SOC) is a suite of reports that look at system-level controls at a service organization. The SOC 1 report focuses on financial matters, while SOC 2 addresses operations and compliance. As Give Lively’s technology is hosted on Amazon Web Services (see below), see the AWS SOC reports about platform operations. Our payment processors' information security policies and controls are also certified to SOC 1 and SOC 2 standards and guidelines.
To process and disburse member donations, we rely on Stripe. By connecting an activated Stripe account to Give Lively – a necessary step for member nonprofits to process Apple Pay or Google Pay donations, or receive deposits into their bank accounts of any money raised through Give Lively – nonprofits grant us permission to process donations, transfer funds and deliver donor data through the Stripe account.
PayPal is an optional donation-processing and disbursement method available to our nonprofit members, but only for one-time donations. By using it in conjunction with Give Lively, a nonprofit allows us to process donations, transfer funds and deliver donor data through its PayPal account.
Just like a bank account, however, a PayPal account is not at all connected to Give Lively. We place confidence in PayPal because of its PCI Level 1 compliance, placing it at the highest level of data security when protecting payment information. Learn more about PayPal's PCI compliance and privacy practices.
We work with Twilio, a cloud communication platform, to power our Text-to-Donate technology. Twilio allows donors to text our shortcode with a nonprofit-specific text code and, in return, receive a link to that nonprofit’s campaign. Learn more about Twilio’s privacy practices.
Amazon Web Services (AWS) is the cloud services platform that Give Lively uses to host its website and all of its technology. Security at AWS is an extremely high priority, built to levels demanded by the most security-sensitive organizations, complete with firewalls, encryption, monitoring, penetration testing and more. Learn more about AWS security.
As a platform for its technology, Give Lively uses Heroku, a PCI Level 1-compliant cloud service for building, delivering, monitoring and scaling apps. Heroku’s security-conscious operations include constant threat monitoring, automatic and seamless vulnerability patching, and 24-hour support. This extends to data synchronization with Salesforce. Heroku’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilizes Amazon Web Service technology. Learn more about Heroku security.
Mandrill is a transactional email service, run by MailChimp, through which Give Lively sends receipts. Although no personal data is permanently filed with Mandrill, what passes through it – donation information, not including bank or card details – is stored for 30-90 days and carefully safeguarded in keeping with legal data protection requirements, as well as laws against spam. Learn more about MailChimp’s data security and privacy and its anti-spam requirements.
We believe all money donated to nonprofits should get to those nonprofits as quickly as possible.
The speed of disbursement is in part a function of the form of payment and whether the nonprofit is a Give Lively member. For Give Lively member nonprofits, funds processed through Stripe are delivered to designated accounts within two business days for credit and debit card donations, and seven business days for bank transfers. (Remember, for this to happen, all nonprofits must have activated Stripe accounts that are connected to Give Lively.) It takes slightly longer – three to seven business days – for funds processed through PayPal to be transferred to a nonprofit’s bank account.
When nonprofits are not Give Lively members, these transfers take longer and involve mailing paper checks. Read more about How Give Lively Disburses Donations.
While we do everything we can to keep data secure and operations seamless, there is no such thing as 100% secure and error-free systems. Unfortunately, service interruptions and failures happen, as do unexpected and very rare instances of fundraising tech misuse.
Whatever the event, we respond to any and all concerns as quickly and thoroughly as possible. Our engineering and membership teams search for solutions, communicate how long they may take, recommend workarounds, if needed, and then advise of fixes once they have been implemented. Followup monitoring, proactive communication with all nonprofit members affected by the interruption, after-the-fact diagnostics and systemwide improvements are all part of the process.
If there is ever any reason to believe that Give Lively and its technology are not doing what they should or that the security of an account has been compromised, please contact us immediately at firstname.lastname@example.org.
Our commitment to nonprofits goes beyond buttressing their fundraising efforts. We also support values that inspire nonprofits to tackle tough challenges and complex issues such as gender equality, LGBTQ+ rights, social and environmental justice and more.
In view of this, we work to terminate all uses of our technology that promote activities not in alignment with our values. These unacceptable uses include: