Security at Community Pledge
Your trust is our top priority. We employ enterprise-grade security practices to protect your data, your donors, and your campaigns.
Encryption
Military-Grade Encryption
All sensitive data is encrypted using AES-256-GCM authenticated encryption with randomly generated salts and initialization vectors.
Secure Password Storage
Passwords are hashed using bcrypt with 12 salt rounds. We check all passwords against known breach databases using k-anonymity to protect your privacy.
Transport Security
All data in transit is protected with TLS 1.3 encryption. We enforce HTTPS across the entire platform.
Authentication
Multi-Factor Authentication
TOTP-based 2FA compatible with Google Authenticator, Authy, and other authenticator apps. Admin accounts require MFA.
WebAuthn/FIDO2 Passkeys
Support for passwordless authentication using passkeys, biometrics, and hardware security keys.
OAuth Providers
Sign in securely with Google, GitHub, Facebook, Discord, or Apple.
Threat Protection
Rate Limiting
Automated rate limiting on all authentication endpoints prevents brute-force attacks and credential stuffing.
Account Lockout
Accounts are automatically locked after 5 failed login attempts for 30 minutes to prevent unauthorized access.
DDoS Protection
Hosted on Vercel's global edge network with automatic DDoS mitigation and traffic filtering.
Monitoring & Audit
Comprehensive Audit Logs
All authentication events, account changes, and security-sensitive operations are logged with timestamps and IP addresses.
Session Monitoring
Track active sessions, review login history, and remotely revoke access from any device.
Security Alerts
Automated monitoring for suspicious activity patterns and unauthorized access attempts.
Payment Security
Your donations are processed with bank-level security
PCI-DSS Level 1 Compliance
All payments are processed through Square, a PCI-DSS Level 1 certified payment processor—the highest level of security in the payment industry.
No Stored Card Numbers
We never store full credit card numbers on our servers. All sensitive payment data is tokenized and stored securely by Square.
Fraud Detection
Square's advanced fraud detection systems monitor transactions in real-time to prevent fraudulent activity and protect donors.
Data Protection
Secure Infrastructure
Hosted on Vercel's secure cloud platform with PostgreSQL databases featuring automatic backups, encryption at rest, and geo-redundancy.
Data Retention
We retain your data only as long as necessary for the purposes outlined in our Privacy Policy. Audit logs are retained for a minimum of 365 days for compliance and security investigations.
Compliance & Privacy
We comply with GDPR, CCPA, and other data protection regulations. You have the right to access, correct, or delete your personal data at any time. See our Privacy Policy for details.
Password History
We prevent reuse of your last 5 passwords to ensure compromised credentials aren't reused. Password history is encrypted before storage.
Incident Response
72-Hour Notification Commitment
In the unlikely event of a data breach affecting your personal information, we commit to notifying all affected users within 72 hours of discovery via email and platform notification, in compliance with GDPR and other data protection laws.
Incident Response Procedures
We maintain documented incident response procedures including threat containment, forensic investigation, user notification, and remediation steps. Our team conducts regular security drills to ensure rapid response capability.
Responsible Disclosure
Help us keep Community Pledge secure
We welcome responsible security researchers to help identify and address potential vulnerabilities. If you discover a security issue, please follow these guidelines:
- Report privately: Email us at security@communitypledge.com with details of the vulnerability.
- Do not publicly disclose: Please do not share the vulnerability publicly until we've had a chance to investigate and patch it.
- Allow time to respond: We will acknowledge your report within 24 hours and aim to provide a resolution timeline within 7 days.
- Coordinated disclosure: Allow us up to 90 days to investigate, develop a fix, and deploy to production before public disclosure.
- Recognition: With your permission, we'll credit you in our security changelog and acknowledge your contribution.
Security Contact
For security-related inquiries, please contact:
security@communitypledge.comExpected response time: Within 24 hours