Two-factor authentication
Staff sign in with an authenticator app or an emailed code, with backup codes for emergencies.
Security & privacy
Your donors trust you.
We protect that trust.
Security is built into every layer of blessed.fund — from how your team signs in to where your data lives.
Account protection
Role-based access
Admin, Manager, Staff, and Viewer roles keep every team member in their lane.
Session control
See every device signed in to your account and sign any of them out remotely.
Bot and abuse protection
Public sign-in pages are protected by CAPTCHA, and requests are rate-limited to stop automated attacks.
Data protection
Encryption
All connections are encrypted in transit. Sensitive organization data, such as payment credentials, is encrypted with AES-256-GCM.
Strict organization isolation
Each nonprofit’s data is separated from every other organization’s, and every request is checked against membership.
Complete audit trail
Every create, update, and delete is logged with who did it and when.
Payments stay with the processor
Card data never touches our servers. Payments are handled by Stripe and Square, both PCI-DSS Level 1 certified.
Infrastructure
Hosted on Amazon Web Services
The platform runs inside a private network (VPC), and the database is not reachable from the public internet.
Automated backups
Databases are backed up automatically every day.
Our privacy promise
Your data is never for sale.
We will never sell or share your donor data with third parties. When you use AI search, only your question and the structure of the database are sent to the AI — never your donors’ names, addresses, or giving records.
Report a security issue
Found a vulnerability?
If you discover a security vulnerability, please report it to us responsibly.
security@blessed.fund