Security & Trust

Security is not a feature for us; it is a core principle of our product. We take the following approach to security:

• Defense in depth
• Principle of least privilege
• Continuous monitoring and testing
• Security-first mindset in engineering

You own your data. Nonprofit Budget Builder only uses your data to provide you with the services you've requested. We do not sell your personal data to third parties.

• We do not sell your personal data.
• We do not share your data with advertisers.
• We only share data with third parties to provide services you've requested.
• You can export your data or delete your account at any time.

We maintain strict internal controls to restrict access to user data. Access is only granted when necessary to provide support or services.

• Role-based access control
• Multi-factor authentication
• Logged and audited access
• Regular access reviews
• Access revoked immediately upon termination

• Secure password hashing
• Multi-factor authentication (MFA)
• Session timeout and management
• Rate limiting and brute force protection
• Automated alerts for suspicious login activity

We use industry-standard encryption to protect your data both in transit and at rest.

All communications between your device and the platform are encrypted using Secure Sockets Layer (SSL) and Transport Layer Security (TLS).

Sensitive data is encrypted at rest using industry-standard AES-256 encryption. Encryption keys are managed using dedicated key management services.

Our platform is hosted on Amazon Web Services (AWS), which provides a secure and resilient cloud infrastructure. We utilize several AWS security features, including:

• Virtual Private Clouds (VPC)
• Network Access Control Lists (NACL)
• Security Groups
• Web Application Firewalls (WAF)
• Intrusion Detection Systems
• DDoS protection

We monitor our systems around the clock for performance, availability, and security.

• Real-time logging and alerting
• Security event monitoring
• Vulnerability scanning
• Performance monitoring
• Uptime monitoring

We perform regular backups of our data to ensure availability and recoverability.

• Daily backups
• Backups are encrypted and stored in multiple locations for redundancy.
• Regular testing of restore procedures.

We conduct background checks on all employees and contractors, subject to local laws and regulations.

Team members receive security training and are required to follow confidentiality agreements and internal security policies.

We maintain secure internal systems to support our operations.

• Centralized identity and access management
• Secure endpoint management
• Regular patching and updates
• Network segmentation
• Malware protection

We work with third-party service providers to help us deliver our services. These partners are selected for their commitment to security and privacy.

• Financial data aggregators (e.g., Plaid, MX, Finicity)
• Cloud infrastructure providers (e.g., AWS)
• Email and communication services
• Analytics and logging tools
• Customer support tools
• Payment processors

In the event of a security incident, we have an incident response plan in place to mitigate the impact and notify affected users.

• Incident identification and categorization
• Containment and eradication
• Recovery and post-incident analysis
• Notification as required by law

We follow secure software development lifecycle (SDLC) practices.

• Code reviews for all changes
• Automated security testing in CI/CD pipeline
• Regular penetration testing by third-party security firms
• Bug bounty program

Security is a shared responsibility between Nonprofit Budget Builder and our users.

• Use a strong, unique password
• Enable multi-factor authentication
• Be cautious of phishing attempts
• Keep your devices and software up to date

We are committed to continuously improving our security posture and adapting to the evolving threat landscape.

If you have any questions or concerns about our security practices, please contact us:

• Visit our Help Center
• Contact our support team at support@nonprofitbudgetbuilder.com
• Report a security vulnerability at security@nonprofitbudgetbuilder.com