Trust
HOW WE LOOK AFTERYOUR DATA.
What a risk or procurement team asks before anything else, answered in checkable terms: how data is encrypted, where each store is and who runs it, who processes data for us, how we are tested, and how to tell us about a vulnerability.
Last reviewed 22 October 2026
Encryption
In transit
- Every public Backed host accepts TLS 1.2 and TLS 1.3 only.
- A plain HTTP request is answered with a redirect to HTTPS before any application code runs.
- Browsers are told to use HTTPS only (HSTS, two years, including subdomains on the platform hosts).
At rest
- The database, its backups and stored files are encrypted at rest by their providers (AES-256, keys managed by the provider).
- Each Organisation’s integration tokens and webhook secrets are sealed again inside the application with AES-256-GCM under that Organisation’s own data key, which is wrapped by a platform key.
- Bank account numbers and Field Review values are sealed inside the application with AES-256-GCM.
- Customer-managed keys are not offered yet.
Where data is kept
| Store | Provider | Region | At rest | In transit |
|---|---|---|---|---|
| Database | Neon (on AWS) | Australia (AWS Sydney) aws-ap-southeast-2 (assumed, to be confirmed) | AES-256, managed by the provider | TLS; unencrypted connections are refused |
| Backups | Neon (on AWS) | Australia (AWS Sydney) aws-ap-southeast-2 (assumed, to be confirmed) | As the database | Held inside the database provider |
| File storage | Vercel Blob | Australia (Sydney) syd1 (assumed, to be confirmed) | Encrypted by the store | HTTPS only, through short-lived signed links |
| Email delivery | Resend | Outside Australia | The provider’s retention of sent mail | TLS to the provider; onward delivery as the recipient’s mail server allows |
| Logs | Vercel and Railway | Outside Australia | Held by each host; personal details are scrubbed before a line is written | HTTPS |
| Error tracking | Grafana Cloud | Australia prod-au-southeast-0 (assumed, to be confirmed; once configured; off today) | The provider’s | HTTPS |
Where data is processed
Some processing and mail delivery happen outside Australia. A row marked “assumed, to be confirmed” is where we have not yet read the region in the provider’s own console.
| Service | Provider | Region |
|---|---|---|
| The platform API | Vercel | Australia (Sydney) syd1 |
| Sign-in | Vercel | Australia (Sydney) syd1 |
| Portals | Vercel | Australia (Sydney) syd1 (assumed, to be confirmed; not yet deployed) |
| Administration | Vercel | Australia (Sydney) syd1 (assumed, to be confirmed) |
| This website | Vercel | Australia (Sydney) syd1 (assumed, to be confirmed) |
| Background jobs | Railway | Outside Australia us-west2 |
| Queues and caches | Railway | Outside Australia us-west2 |
| Malware scanning | Railway | Outside Australia (not yet deployed) |
Subprocessors
The current list is kept by the platform, which we couldn’t reach just now. Please try again shortly, or read it in the Legal Centre.
Independent testing
An independent penetration test every year. Last independent test: No independent test yet; the first is planned.
Assurance
SOC 2 Type II — preparing; no report issued.
We do not claim a certification we do not hold. Our controls are mapped to SOC 2, ISO 27001 and the ISM, and we would rather send your assessors the documents than show a badge: ask support@backed.giving for the security pack.
Controls we cite
SC-2Every signed-in request is checked on the server against a live session.SC-88One Organisation’s records answer another Organisation exactly as records that do not exist.SC-135A daily production check proves that reads across Organisations return nothing.SC-129Each Organisation’s secrets are sealed under its own data key.SC-39The audit trail is append-only: no change or deletion reaches an audit entry.SC-125The platform connects out only to the destinations named in one reviewed list.SC-166security.txt is served on every host and kept inside its expiry.
Availability
Backed keeps an internal availability objective for the Web Platform, measured every calendar month and excluding maintenance we announce in advance. It is an engineering objective, not a contractual commitment: we use reasonable endeavours to meet it, and the status page shows how the platform is running now and over the last 90 days.
Report a vulnerability
Email security@backed.giving. Read the disclosure policy for what is in scope and how we respond. Machine-readable contact details are at /.well-known/security.txt.