Data Security Policy

This policy describes how Impacturi (operated by Clickonic Ltd) protects the personal data and donor information entrusted to us by our customers. We handle data belonging to charities and their donors, and we take that responsibility seriously.

1. Infrastructure and hosting

• Database: Hosted on Supabase (PostgreSQL). Supabase is SOC 2 Type II certified. Data is encrypted at rest using AES-256.
• Application: Hosted on Vercel. All traffic is served over HTTPS with TLS 1.2 or higher. Vercel is SOC 2 Type II certified.
• Payments: Processed by Stripe. No card numbers or payment details are stored on our infrastructure. Stripe is PCI DSS Level 1 certified.
• Automated writing services: Impact pages are written and checked with the help of the OpenAI and Anthropic APIs. Text only is sent, as set out in section 13 of our Data Processing Agreement. Data sent to OpenAI is used only to generate or check the requested content and is not used to train models (per OpenAI's API data usage policy).

2. Access control

• Row-level security: Enforced at the database layer on all tables containing customer data. Each charity can only query, insert, update, or delete their own records. This is not application-level logic that could be bypassed; it is enforced by PostgreSQL itself.
• Authentication: Managed by Supabase Auth. Passwords are hashed using bcrypt. Session tokens are short-lived and rotated automatically.
• Admin access: The platform owner does not have routine access to customer data through the application. Direct database access is restricted and used only for maintenance, debugging, or at the customer's request.

3. Data in transit

All data transmitted between users and the platform is encrypted using TLS. This includes browser sessions, API calls, CRM sync connections, and file uploads. We do not support unencrypted HTTP connections.

4. Data at rest

All data stored in the database is encrypted at rest using AES-256, provided by the hosting infrastructure. Uploaded files (logos, photos) are stored in Supabase Storage with the same encryption standards.

Additional technical detail

This section carries the engineering detail that used to sit on our public Security page.

• Encryption: All data in transit over TLS 1.3. All data at rest encrypted at the database layer. CRM integration credentials are stored with encrypted key management.
• EU hosting: The database is Postgres on Supabase Pro in EU-west-1 (Ireland), so donor records are stored in the EU and page rendering makes no cross-Atlantic round trip. Some other services we use are outside the EU, for example Resend for email. Every service that handles your data is named in our Data Processing Agreement.
• Checks before anything is published: Approval happens on our server after our checks have run, and records who approved it. Every number, date, amount, percentage, name and pronoun must trace back to the facts the charity gave us. A sentence that joins two facts in a way the charity did not gets a separate check. Where a page involves somebody under 18, code checks every public word for health details, and a second, independent check asks the same question. If either finds a problem, or does not answer, the page is blocked.
• Row-level security: Every charity sees only its own data, enforced at the database rather than in the application, so an ordinary bug in our code cannot cross from one charity to another. Some server routes use an elevated key that steps around that check, because the database check alone cannot do their job. Among them are scheduled jobs that run with nobody signed in, and public endpoints that take a comment, a click or an enquiry from a visitor who has no account. On those routes it is our own code, not the database, that keeps one charity's data apart from another's. Tenant isolation is re-tested every week against the live database using the public key that ships in every visitor's browser, exactly as an attacker would.
• Multi-factor authentication: TOTP-based 2FA on platform admin and the production deploy chain. Domain lock on the registrar. FileVault on engineering laptops. Not yet everywhere: four delivery and supplier accounts still need it, and that work is outstanding rather than done.
• Backups: Daily automated database backups with eight-day retention. A scheduled daily job is built to copy uploaded files (logos and photographs) to separate storage, but we have not yet shown that it runs reliably, so we do not currently promise that a separate copy of uploaded files exists. If a separate copy does exist, the job only ever adds files and never removes them, so we cannot give a fixed period after which a deleted file leaves it. Restore testing has not yet been carried out: we have not restored a backup and verified it, so we do not claim a proven recovery time. Scheduled for Q4 2026.

5. CRM integration security

When a charity connects an external CRM, the API credential is encrypted at rest in a dedicated secrets vault, separate from the ordinary application tables. It is decrypted only in memory, only for the duration of that charity's own sync, and is never returned to the browser. Access is restricted to the charity that created it, and that ownership is proved on the server before any operation runs, including disconnection.

We also limit what a connected CRM can expose if something goes wrong upstream. Error responses from a CRM are recorded by status code only, never by content, so a fault at the CRM's end cannot copy donor records into our logs or our error monitoring. Credentials and personal data are stripped from anything sent to our error-monitoring provider. Every sync is bounded, so no single connection can be used to exhaust the platform.

Disconnecting is immediate and complete: the stored credential is destroyed at the point you disconnect. You can also revoke the key at your CRM at any time, without involving us, and the connection stops working straight away.

6. Backups

Database backups are managed automatically by Supabase. Backups are encrypted and retained according to the hosting provider's backup policy. We do not maintain separate backup infrastructure.

7. Vulnerability management

Since 6 August 2026 our security review runs as an automated job every Monday at 08:00 rather than as a periodic manual exercise. Each run is recorded, and a failure raises an alert the same morning.

• Weekly automated review: every Monday the platform is checked for known vulnerabilities in its dependencies, for correct isolation between customer accounts, for the security headers being live and enforcing, and for the specific safeguards that protect connected CRM credentials. Any failure is alerted and dated.
• Dependency patching: known vulnerabilities in production dependencies are held at zero. The weekly job fails if that is not the case, so a missed patch surfaces within seven days rather than at the next manual review.
• Automated safeguards on every code change: the checks that protect connected CRM credentials and donor data run as tests, so a future change cannot quietly remove them.
• Independent testing: we have not commissioned a third-party penetration test. We will say so plainly rather than imply otherwise, and we will update this page if that changes.
• Cyber Essentials certification: in progress. Target: Q4 2026.

8. Incident response

We maintain an Incident Response Plan that defines how we detect, respond to, and communicate about security incidents. In the event of a personal data breach, Clickonic (as Processor) will notify the affected charity (as Controller) within 24 hours of discovery. The charity is then responsible for assessing ICO notification requirements within the statutory 72-hour window.

9. Staff and confidentiality

All individuals with access to production systems are bound by confidentiality obligations. Access is granted on a need-to-know basis and reviewed regularly.

10. Third-party certifications

Our infrastructure providers hold the following certifications:

• Supabase: SOC 2 Type II
• Vercel: SOC 2 Type II
• Stripe: PCI DSS Level 1

Impacturi is working towards Cyber Essentials certification. This page will be updated when certification is achieved.

11. Your responsibilities

As a customer, you are responsible for:

• Keeping your login credentials secure and not sharing them
• Ensuring the donor data you upload is accurate and lawfully obtained
• Informing your donors that their data is processed through the Impacturi platform
• Reporting any suspected security issues to us promptly

12. Contact

For security questions, to report a vulnerability, or to request a copy of this policy in PDF format, contact:

Security Team, Clickonic Ltd
dermot@clickonic.co

Dermot Dennehy, Founder, Clickonic Ltd
dermot@clickonic.co