# Secure Donation Processing and Donor Data | Donatefy > How Donatefy keeps donation processing secure: payments processed by Stripe, direct settlement to your account, no stored card numbers, and role-based access. Source: https://www.donatefy.org/security Updated: 2026-10-15 Trust & security ## Secure donation processing, built so the money and the data behave. How Donatefy handles payments, donor data, and platform access. Written plainly, because trust pages should be readable. Last updated: October 13, 2026 ### The architecture is the security. Donatefy never holds your money. Donations settle directly into your organization's own Stripe account, so continuity does not depend on us. If Donatefy vanished tomorrow, your Stripe account, your donors, and your recurring plans would still be yours, **because they never lived anywhere else.The donor's card** Any channel, any payment method Yours, not ours **Your own Stripe account** Every donation settles here directly **Your bank** Standard Stripe payouts Runs on your organization's own Stripe account. Standard Stripe payouts. Donatefy is fundraising software for organizations that answer to donors, boards, and auditors. This page explains how payments move, what data we hold, and who can touch what. For the formal legal documents, see our [Privacy Policy](https://www.donatefy.org/privacy) and [Terms of Service](https://www.donatefy.org/terms). ### 1. Payments are processed by Stripe Every donation on Donatefy, whether it comes through a giving page, an embedded form, a QR code, or an in-person device, is processed by Stripe. Stripe captures card details in its own payment systems. **Full card numbers are never stored on Donatefy servers**, and they never pass through our databases. In-person giving works the same way. The integrated reader on our 22-inch smart kiosks, the Stripe Reader S700 and S710 handhelds, and the Mobile App with Tap to Pay on iPhone and Android all use Stripe Terminal payment flows, so a tap at a kiosk gets the same payment handling as a donation made from a laptop at home. See [in-person fundraising](https://www.donatefy.org/in-person-fundraising) for how the hardware fits together. Donatefy is a verified Stripe Partner. Because Stripe processes the payments, donors and organizations may also be subject to the Stripe terms and privacy policy. ![Verified Stripe Partner](https://www.donatefy.org/assets/stripe-partner-dark.svg) ### 2. Donations settle into your Stripe account, not ours Funds move from the donor to your organization's own Stripe account. Donatefy never holds, pools, or transmits donor money. There is no Donatefy escrow account, no waiting period we control, and no commingling of funds across organizations. Fees are shown as line items, not buried in a net number, so your finance team can reconcile every payout against every donation. Refunds, full or partial, are issued by your team from your own dashboard, and the money flows back through the same Stripe rails it arrived on. For the processing rates Stripe publishes, how eligible nonprofits ask Stripe for nonprofit pricing, and how donors can choose to cover the fee, see [how Donatefy works with Stripe](https://www.donatefy.org/stripe-integration). **The short version:** your donations, your Stripe account, your money. Donatefy is the software layer, not a middleman holding funds. ### 3. What we store, and what we do not #### What we store - **Donor records:** name, email, and any contact fields your organization chooses to collect. - **Donation details:** amount, date, campaign, channel, device, recurring plan status, and whether the donor chose to cover fees. - **Receipt records:** the confirmations, recurring receipts, and year-end summaries generated for your donors. #### What we do not store - **Full payment card numbers.** Those stay with Stripe, where they belong. Your donor relationships belong to your organization. You can sync donation data to your own systems through [integrations](https://www.donatefy.org/integrations) with QuickBooks, Blackbaud, Bloomerang, Salesforce, Mailchimp, and Kindful, and if you ever leave Donatefy, you can export your donor and donation records and take them with you. More on how records are organized in [donor management](https://www.donatefy.org/donor-management). ### 4. Access is role-based by design Not everyone on your team needs to see everything. Donatefy uses role-based permissions so each person gets the access their job requires and nothing more: #### Admin roles Manage settings, team members, and integrations. #### Finance roles Handle payouts, refunds, and reconciliation. #### Campaign roles Build and run campaigns without touching financial controls. #### Limited roles See only what they are assigned. Least privilege is the default posture, not an add-on. See [admin and reporting](https://www.donatefy.org/admin-reporting) for how permissions map to day-to-day work. ### 5. How we run the platform #### Encrypted connections Web, giving page, and Donor Portal traffic travels over TLS-encrypted connections. #### Environment separation Production systems are kept separate from development and testing environments, so live donor data stays where it belongs. #### Audited refunds Every refund action is recorded at the transaction level: who issued it, when, and for how much. #### Device visibility Kiosks and readers report their status, and our team provides remote support, so a device problem on a Sunday morning gets seen and handled. We describe what we actually do rather than leaning on badges. If your organization has a security questionnaire or a diligence process, we are glad to work through it. Reach out via [a demo](https://www.donatefy.org/demo) or the contact below. ### 6. Receipts and tax accuracy Your organization controls its receipt content: logo, EIN, and the tax language your donors see. Donatefy generates confirmations, recurring receipts, and year-end summaries from the settings you configure. We provide the [tooling](https://www.donatefy.org/receipts), not tax advice. Your tax professional should confirm that your receipt language meets the requirements that apply to your organization. ### 7. Responsible disclosure If you believe you have found a security vulnerability in Donatefy, we want to hear from you. Email [info@donatefy.org](mailto:info@donatefy.org) with enough detail to reproduce the issue. Please give us a reasonable window to investigate and fix before public disclosure, and do not access, modify, or retain donor or organization data beyond what is needed to demonstrate the issue. We take good-faith reports seriously and will respond to every credible submission. ### 8. Security questions Short answers to what organizations ask most. For diligence requests or anything this page did not answer, email [info@donatefy.org](mailto:info@donatefy.org). For the full legal picture, read our [Privacy Policy](https://www.donatefy.org/privacy) and [Terms of Service](https://www.donatefy.org/terms). Want to see the platform before you trust it? [Book a demo](https://www.donatefy.org/demo). **Does Donatefy store card numbers?** No. Stripe captures card details in its own payment systems, and full card numbers are never stored on Donatefy servers. **Where do donations settle?** Directly into your organization's own Stripe account, on your payout schedule. Donatefy never holds, pools, or transmits donor money. **Who can issue refunds?** Team members with refund permissions, such as your finance role, issue full or partial refunds from the donation record. Every refund is recorded with who issued it, when, and for how much. **Can we take our data with us if we leave?** Yes. You can export your donor and donation records, and your Stripe account, donor payment relationships, and recurring plans stay yours. ### Two pledges, in writing. #### Yours means yours - Every donation settles in your own Stripe account - Donor records and receipts are never deleted on downgrade - Locked never means erased: reactivate and everything returns - Your Stripe history is yours, with or without Donatefy #### Leave whenever you want - Month-to-month on every self-serve plan - No auto-renew traps, Enterprise included - Recurring plans live in your Stripe account and survive your exit - Hardware is owned, never rented back to you ### Bring your security questionnaire to the demo. We will walk through the architecture, the data flow, and your own Stripe account, live and in plain English. [Walk through security live](https://www.donatefy.org/demo)