SECURITY & CONTROL
Care is part
of the connection.
Clear permissions, deliberate review, and a record of each transfer are central to how Giving Bridge is built.
Giving data deserves a careful workflow. We describe the controls in the product plainly, without treating them as a guarantee that every risk or error can be eliminated.
Access stays
with the workspace.
The private pilot requires authenticated access. Workspace membership and role checks govern protected actions. Connecting a provider grants only the permissions that its authorization process allows.
Connection secrets
stay on the server.
Saved provider credentials are encrypted by the application on the server and are not included in the normal workspace display. Public website files contain no account credentials or donor records.
Identity comes
before automation.
A person confirms each initial donor match. Fund and account mappings are separate choices. New, unmatched, changed, and unsupported records can be held for review.
Uncertainty
gets attention.
Saved source references, transfer intent, destination results, and activity history support duplicate checks and reconciliation. An uncertain provider response is a reason to investigate before another write.
Your controls
remain available.
You can keep automation paused, review records, and disconnect a provider. Local disconnection removes usable connection credentials and pauses automated provider processing. Retained workspace records and completed donations require separate review or data-request steps.
Help us address it responsibly.
Send the affected page, a description, and safe steps to reproduce the issue. Please omit credentials and unnecessary donor information.