Security
How donor data is protected: database-enforced tenant isolation, role-based access, encryption, Stripe-handled payments, backups, audit trails, incident response, and responsible disclosure.
Every organization's data is separated by row-level security enforced inside the database itself — not just in application code. A user's queries can only ever reach the organizations they belong to, and that boundary holds even if a bug slipped past the application layer.
Access inside an organization follows roles (owner, admin, editor, viewer), so staff and volunteers see what their role allows. Do Good Labs support access is limited to authorized personnel with a business need, on the least-privilege principle.
All traffic between browsers, the application, and the database is encrypted in transit with TLS. Data at rest is encrypted by our database and storage provider.
Card details are collected and processed by Stripe, a PCI-DSS Level 1 provider. Full card numbers and CVV codes never pass through or get stored on doGood systems.
The database is backed up automatically by our infrastructure provider, and customer data can be exported in common formats at any time — your data is never held hostage.
Changes to important records are tracked with an audit history, so organizations can see what changed and when.
The service is monitored for errors, performance, and unusual activity so problems are caught and fixed quickly.
If we determine a security incident has affected customer data, we notify affected customers without unreasonable delay, consistent with legal obligations and the facts available.
If you believe you've found a security vulnerability in doGood, please tell us at hello@dogoodlabs.com. We take reports seriously, respond promptly, and appreciate coordinated disclosure.
doGood runs on a small set of established infrastructure providers — Vercel, Supabase, Stripe, Resend, Anthropic, OpenAI, and Google — each with its own strong security program. The full subprocessor list with roles lives in our Data Processing Addendum.