Donor records are among the most sensitive data a charity holds. GivingSignal is engineered so that data stays in Canada, stays encrypted, and never reaches our AI in a form that can identify a person.
Plain commitments that cover your whole account — sign-in, storage, email and AI — so your team and board know exactly what to hold us to.
The common ways web apps get breached — and exactly how GivingSignal shuts each one down.
A strict Content-Security-Policy limits scripts to trusted sources, and everything users enter is escaped before it is ever displayed.
> CSP · output escapingX-Frame-Options: DENY and a frame-ancestors ‘none’ policy stop the app from being hidden inside a malicious page.
> X-Frame-Options: DENYLogin attempts are rate-limited per IP address, so automated password-guessing stalls almost immediately.
> Rate limit per IPEvery request re-verifies that you own the organisation and record you’re touching — you can only ever reach your own donors.
> Ownership re-checkAll database access uses parameterised queries. User input is never concatenated into a SQL statement.
> Parameterised queriesUnsubscribe and tracking links are HMAC-signed, and OAuth sign-in flows use nonce validation to block CSRF.
> HMAC · OAuth nonceHSTS forces encrypted HTTPS on every connection, with preload — there is no silent downgrade to plain HTTP.
> HSTS · preloadEmail and SMTP credentials are encrypted with AES-256-GCM; a tampered value fails its authentication tag and is rejected.
> AES-256-GCM · auth tagYour donor data sits at the centre, wrapped in six independent layers. To reach it, an attacker has to get past every one — from the outside world all the way in — and defeating one still leaves the rest.
The outer wall. Every connection is forced over HTTPS with HSTS, and a strict Content-Security-Policy plus locked-down headers stop anyone intercepting traffic or injecting scripts to get a foothold.
Nothing responds without an authenticated account — and sign-in attempts are rate-limited per IP, so stolen or guessed passwords stall before they ever get through.
Even once signed in, every request re-checks that you own the organisation you're asking about, and row-level security walls each charity off from every other — so one account can never reach another's donors.
If storage itself were ever reached, sensitive credentials — email OAuth tokens and SMTP passwords — are AES-256-GCM encrypted and useless without the key.
Anything sent for AI analysis has names and emails stripped first and replaced with anonymous identifiers — personal data never leaves in a form that can identify a person.
The innermost layer, wrapped around the data itself — consent limits, purpose limitation and the right to be forgotten control what is ever kept, and deleting a donor cascades through every related record.
The protections most tools never talk about — because we built them before we needed to explain them.
Here is the path a donor record takes before any insight is generated — and we never use your data to train models.
Stored on Canadian infrastructure and isolated to your organisation with row-level security.
Names and emails are removed and replaced with anonymous identifiers before anything is sent to an AI model.
The model sees identifiers like Acct-0001 and giving patterns — never the people behind them.
Scores and campaign insights appear inside your GivingSignal account, where your roles and permissions apply.