We protect personal data with a combination of technical and organizational safeguards, proportionate to the sensitivity of what we hold and the fact that some of it concerns vulnerable young people.
14.1 Technical safeguards
- Role-based, and in some cases row-level, access control, so each user sees only what their role requires (Section 6.3).
- All configuration and secrets (database credentials, application keys) are held in environment variables, never hardcoded or committed to source code.
- Protective on-delete rules on financial records (donations, expenses, funds) prevent money data from being silently orphaned or destroyed.
- Encrypted connections (HTTPS/TLS) for the operations platform and any future public-facing site.
- Real donation and financial records are kept only on persistent, non-ephemeral database infrastructure — never on a free tier that could be silently deleted.
14.2 Organizational safeguards
- Access is granted by role, reviewed when someone's responsibilities change, and revoked promptly when a staff member, mentor, or volunteer leaves.
- Case notes and other sensitive internal fields are visible only to the roles that need them to do their job.
- This policy, and the underlying consent records it depends on, are reviewed periodically (Section 22) and updated as the platform's features (e.g., the donor portal, the marketing site) move from design into production.
- Anyone handling beneficiary or donor data is expected to understand and follow this policy as a condition of their role.
No system is perfectly secure, and this policy does not promise otherwise. Section 18 describes what happens if something goes wrong despite these safeguards.