Security overview.
These reflect an internal self-assessment of our controls against the SOC 2 and ISO 27001 frameworks. They are not certifications or third-party audit attestations.
Encryption
Data in transit is encrypted using TLS 1.2+. All data is encrypted at rest using AES-256 at the hosting layer. Onboarding document uploads are stored as private files and opened only through short-lived signed URLs — 15 minutes for reviewers, 5 minutes for the malware scanner; they are queued for scanning at upload and scanned when the application is submitted. Attachments sent through an applicant's "more information" reply or a verification-link response, and documents uploaded before private storage was introduced, still use a stored file URL rather than a signed one. Every response also carries a Strict-Transport-Security header (two years, including subdomains) and a Content-Security-Policy generated from a single source and served as a header.
Designated sensitive fields — EIN, banking details (routing and account numbers), and signer government-ID image references — carry an additional layer of per-tenant AES-256-GCM application-layer encryption. They are made readable only to an owner, admin or reviewer — never a viewer — through an explicit, second-factor-gated, audit-logged decrypt action that reveals the full values. Applicants cannot invoke that decrypt; the one applicant-facing exception is a nonprofit's own previously entered manual bank details, carried forward to pre-fill its next application. Everywhere else — accounts verified through Stripe or GIACT, cross-tenant fraud matches, the shared negative file, and your own billing payment method — bank-account values appear only as their last four digits.
For cross-tenant fraud matching, identifiers are compared as keyed, non-reversible hashes — never as raw values — so no clear identifier is pooled across enterprise workspaces.
Secrets and key management
Per-tenant encryption keys, webhook signing secrets, and payment-method tokens are held in a dedicated, service-role-only secret store. They live on records that no tenant member can read — not owners, not admins — and are reachable only by backend functions, never by the browser or any client query.
A webhook signing secret is displayed exactly once, at the moment you generate or rotate it, and cannot be retrieved again afterward — only regenerated. The same secret signs webhook deliveries, is the key your backend uses to approve each finalized submission when the optional per-submission authorization hook is enabled, and authorizes your backend's server-to-server calls (minting one-time intake links and onboarding invitations). Rotating it invalidates the previous value immediately.
Sub-processors
All data is stored and processed in the United States. There is no cross-border data transfer to non-US sub-processors.
| Service | Purpose | Data class | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database, file storage | All submitted data | US |
| Stripe | Identity, EIN, and bank ownership verification | PII, financial data | US |
| Cloudflare, Inc. | Human-verification challenge (Turnstile) and network-layer security | Challenge token, IP address | Global edge |
| Klaw | Dark-web, surface-web, breach-exposure, and PEP screening of contact identities | Contact names, email addresses | US |
| IRS (public API) | Publication 78 / Tax Exempt Organization Search 501(c)(3) status lookup | EIN, org name | US |
| VirusTotal (Google LLC) | Malware scanning of uploaded documents | Document hashes and content | US |
Report a security issue
Report a security issue to information@daf-connect.com. We respond within one business day. We do not operate a bug bounty program at this time, but we will acknowledge your report and keep you informed of remediation status. Please do not publish vulnerability details publicly until we have had 90 days to address the issue.
information@daf-connect.com