Is Nucleus Giving Secure?
Yes! We use 256-bit encryption, which is the same level as every major bank. Our GivingFlows use secure tokens, so that givers' information is protected. We are also PCI compliant along with our Tier 1 processing partner (one of the top 3 in the world).
This means every transaction through Nucleus Giving meets a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment. But we also go above and beyond that and have built in Nucleus Giving exclusive privacy and accountability permissions, to allow for example, Pastor-level access where they can run reports, and see giving health, without seeing the specific donor names attached to specific gift amounts.
For US-based churches, when you sign in to your bank account using Plaid, you'll take advantage of their secure system which is trusted by JPMorgan Chase, Citi, American Express, Venmo, Wealthsimple and others. Don't worry - your credentials will never be made accessible to linked applications. Learn more about Plaid here.
Financial partners we work with:
Plaid: Used to securely connect bank accounts
CardConnect (A First Data company): Used as our secure gateway to manage payments
BluePay (Acquired by First Data): Used to process bank transfer payments for US-based churches
Storing data
All data is stored in DynamoDB and is encrypted at rest. Keys are stored in AWS KMS. We do continuous backups which allow us to restore to any point in time in the last 35 days. Additionally, AWS Replicates DynamoDB data across multiple AZ's to ensure availability.
To explain further, our system and the way it's been specifically architected - along with the way we store information - givers cannot truly be “hacked”. The most modern server technology and privacy constraints were utilized in the core architecture of RebelGive - from the data storage provider we use (who is PCI level 1 compliant), to the way we allow access to our APIs, which are tightly locked down and don't expose data in an unencrypted way.
For example, if someone "hacked" into an account or breached our core system, they could not access the giver's credit card / banking information or account password. We don’t store any of that information in plain text or in unsecured databases. Usually when you hear about breaches in the news, they stored information in unprotected databases, where information that should have been encrypted was instead stored unencrypted, which is then vulnerable and accessible to hackers.
Big picture: Data breaches or "hacks" are usually only a big deal when there are bad security policies and programming where sensitive data is stored unsecured and unencrypted. It's always so unbelievable to us what some huge companies do and get away with (like Facebook).
All that to say, we're extremely careful about security and privacy, along with limiting access because we are dealing with financial data.