Trust & security

Security you can
explain to your board.

Your community's gifts and data deserve more than a promise. Here is exactly how Givana keeps both safe, in plain language.

Your bank, not ours
Gifts go to your own Stripe account.
PCI-DSS
Card data never touches us.
Encrypted
In transit & at rest.
Reconciled
Every gift confirmed, not guessed.
Where the money goes

Givana never holds your funds.

Donor
Pays with their card
→
Processor
Charges the card & pays out
→
Your community bank
Receives the payout

Money moves from the donor through the payment processor straight into your community's own bank account. Givana sits alongside the flow to record and reconcile it. We never take custody of your gifts.

How we protect it

Four things we never compromise

Card data

We never see card numbers

Payment details are entered into the PCI-certified processor's secure fields and tokenized. Card numbers never reach Givana's servers, so there's nothing sensitive for us to lose.

Truth

Reconciled from confirmed payments

Every gift is confirmed by a signed webhook from Stripe when the payment succeeds, not by a hopeful browser redirect. Payouts to your bank are tracked separately, so your records match what Stripe processed and paid out.

Access

Role-based access & audit

Invite your team with the right level of access: view-only for counters, full control for admins. Sensitive actions are logged so you always know who did what.

Ownership

Your data stays yours

Export your donations, donors and statements at any time. No lock-in, no holding your records hostage. If you ever leave, you take everything with you.

Built on Stripe

Payments are processed by Stripe, a PCI Service Provider Level 1 processor trusted by millions of businesses worldwide. Each community connects its own Stripe account during setup, so funds and compliance sit with you. Givana orchestrates the giving experience and the records on top.

Engineering practices

The quiet work underneath

✓Encryption everywhereHTTPS (TLS) on every connection. Card details go straight to Stripe and never reach our servers.
✓Tenant isolationEach community's data is scoped and isolated. One community can never see another's.
✓Idempotent, verified webhooksSigned events are verified and de-duplicated, so a gift is never double-counted or lost.
✓Least-privilege & secrets hygieneSecrets live outside the code and never reach the browser. Givana staff get only the access their role needs, and must use two-step sign-in. It's available on every account.

Trust, by design.

Have a security questionnaire from your board? Send it our way.