Security Overview

Payment Security

Online card payments made through GiveWheel are securely processed by Stripe.

GiveWheel does not store or directly process customers' full payment card details. Payment information is entered into Stripe's secure payment infrastructure and is handled by Stripe in accordance with its security and compliance requirements.

Stripe is a PCI DSS Level 1 Service Provider, the highest level of certification available under the Payment Card Industry Data Security Standard.

By using Stripe for payment processing, GiveWheel is able to minimise the amount of sensitive payment information handled directly by our own systems.

Data Protection

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, disclosure, alteration or destruction.

Depending on the nature of the information and the system involved, these measures include:

1. Encryption of data in transit using HTTPS/TLS.
2. Secure storage of user passwords using industry-standard password hashing.
3. Role-based access controls designed to restrict access to authorised personnel.
4. Authentication and access controls protecting administrative systems.
5. Logging and monitoring of relevant platform activity to help identify and investigate potential security issues.
6. Appropriate controls over access to systems and personal information.

Our handling of personal data is described in our Privacy Policy and is subject to applicable UK data protection legislation, including the UK GDPR.

Application Security

Security is considered throughout the development and operation of the GiveWheel platform.

Our application security practices include:

1. Keeping application software and dependencies appropriately updated.
2. Applying security patches where relevant.
3. Reviewing third-party software dependencies for security and maintenance considerations.
4. Testing and reviewing the application for common web application security risks, including risks identified by the OWASP Top 10.
5. Following secure software development practices.
6. Conducting code review as part of the development process.

We continually review and improve our security practices as the platform and the threat landscape evolve.

Availability and Resilience

We recognise the importance of maintaining a reliable fundraising platform for charities, fundraisers and event organisers.

To support service continuity and recovery, we:

1. Monitor the health and availability of our platform.
2. Maintain regular backups of critical application data.
3. Maintain processes for responding to operational and security incidents.
4. Investigate and resolve service issues as promptly as reasonably practicable.
5. Continually review opportunities to improve the resilience and reliability of our systems.

While no online service can guarantee uninterrupted availability, we take reasonable steps to minimise disruption and restore services as quickly as reasonably practicable when incidents occur.

Third-Party Service Providers

GiveWheel relies on carefully selected technology and service providers to operate parts of its platform.

Key providers include:

1. Heroku (Salesforce): cloud hosting and application infrastructure.
2. Stripe: secure payment processing.
3. Amazon Web Services (AWS): infrastructure used within the hosting environment where applicable.

We assess the security and suitability of third-party providers as appropriate to the services they provide. These providers operate their own security and compliance programmes and are responsible for the security of the infrastructure and services they provide to us.

Where appropriate, our use of third-party providers is governed by contractual and technical controls designed to protect information processed on our behalf.

Responsible Disclosure

We take security vulnerabilities seriously and encourage responsible disclosure.

If you believe you have identified a security vulnerability affecting GiveWheel, please contact us at [email protected] with sufficient information for us to understand and reproduce the issue.

We will acknowledge legitimate reports promptly, investigate reported vulnerabilities appropriately and work to address confirmed security issues as quickly as reasonably practicable.

When reporting a vulnerability, we ask security researchers to:

1. Avoid accessing, modifying or deleting personal or other user data.
2. Avoid disrupting or degrading our services.
3. Test only against accounts and systems they are authorised to access.
4. Provide sufficient information to reproduce and investigate the issue.
5. Allow us a reasonable opportunity to investigate and remediate a confirmed vulnerability before publicly disclosing it.

Security Limitations

We recognise that no internet-connected system can be guaranteed to be completely secure.

Our security measures are designed to reduce risk and protect the confidentiality, integrity and availability of information, but they cannot eliminate every possible security threat or guarantee that a security incident will never occur.

We continually review our systems and processes and seek to improve our security posture as new technologies, vulnerabilities and threats emerge.