Security & Data Protection

Last Updated: 5 November 2026

People's Fundraising is designed to provide charities, not-for-profits and their supporters with a secure, reliable and responsible fundraising platform.

We recognise that organisations trust us with important fundraising activity and personal information. Security, data protection and platform resilience are therefore built into the way People's Fundraising is developed, operated and supported.

• Security at a glance
• Secure hosting and infrastructure
• Protecting access to the platform
• Payment security
• Data protection and UK GDPR
• How we use and share data
• Data storage and international transfers
• Platform resilience and monitoring
• Backups and recovery
• Secure software development
• Security testing and vulnerability management
• Incident response
• Third-party services
• Responsible fundraising
• Ongoing security
• Further information

Security at a glance

People's Fundraising uses a range of technical and organisational measures to protect the platform, fundraising organisations and supporters.

• Hosted using Amazon Web Services (AWS) in the London eu-west-2 region.
• Data encrypted in transit using HTTPS/TLS and encrypted at rest within our AWS infrastructure.
• Strong authentication and role-based access controls for administrative and privileged access.
• Automated database backups, snapshots and Amazon S3 versioning.
• Backups retained for at least six months and for longer where required by law.
• AWS infrastructure monitoring, application monitoring, automated alerts and uptime monitoring.
• Regular vulnerability scanning, penetration testing and other security testing.
• People's Fundraising does not store full card numbers or CVV security codes. Card details are handled by our specialist payment providers.
• Organisation-controlled supporter information is held on behalf of the organisation as controller; it is not sold, profiled or used for our own advertising or unrelated commercial purposes.
• Data protection processes aligned with UK GDPR and the Data Protection Act 2018.
• Incident response procedures, including data breach assessment and notification where required.
• Registration with the Information Commissioner's Office (ICO) and the Fundraising Regulator.

Secure hosting and infrastructure

People's Fundraising is hosted using Amazon Web Services (AWS), one of the world's leading cloud infrastructure providers.

Our production infrastructure is hosted in the AWS London region ( eu-west-2 ). The platform uses AWS services including Elastic Beanstalk, Relational Database Service (RDS) and Amazon S3 to provide a scalable, secure and resilient technology environment.

Our infrastructure is designed so that application, database and storage services are appropriately separated. AWS infrastructure also provides security capabilities including network protection, physical data-centre security and infrastructure redundancy.

Data transmitted between users and People's Fundraising is encrypted using HTTPS/TLS. Data stored within our AWS environment, including data held within RDS and S3, is encrypted at rest.

Our infrastructure and application environment are monitored using AWS and application monitoring services, including automated alerts and uptime monitoring, so that operational or security issues can be identified and investigated promptly.

Protecting access to the platform

We use multiple layers of protection to help prevent unauthorised access, malicious activity and misuse of the platform.

These include secure authentication controls, additional account authentication measures, automated protection against malicious or automated activity, browser security controls and role-based access to administrative functionality.

Administrative and privileged access to systems and personal information is restricted to authorised people who require it to operate, maintain or support the service.

Administrative activity is logged where appropriate so that access and changes can be reviewed and investigated when necessary.

Payment security

Payments made through People's Fundraising are processed using specialist payment providers and payment infrastructure.

People's Fundraising does not store full card numbers, full card details or CVV security codes. These details are handled directly by our specialist payment providers.

People's Fundraising stores transaction identifiers and associated transaction information required to operate the fundraising service, provide support, reconcile payments and maintain appropriate financial records.

This approach means that sensitive card credentials are kept outside People's Fundraising systems and handled by organisations specialising in secure payment processing.

We continually review our payment integrations as payment technologies, security requirements and industry standards evolve.

Data protection and UK GDPR

People's Fundraising takes its responsibilities under UK data protection law seriously.

Golden Giving Limited, trading as People's Fundraising, is registered with the Information Commissioner's Office (ICO).

We process personal information in accordance with applicable UK data protection legislation, including UK GDPR and the Data Protection Act 2018. For the private supporter and fundraising records an organisation collects for its own purposes, the organisation is the Data Controller and PF acts as its Data Processor by storing, securing and making the data available on the organisation's instructions. The safeguards described on this page protect that processor-held information.

PF separately acts as an independent Data Controller for certain account, service, security, payment, fraud and statutory purposes where PF itself determines the purposes and essential means of processing. Our Privacy Policy explains the distinction, while our Data Processing Schedule sets out contractual duties where PF is acting as an organisation's processor.

We aim to collect only the personal information required to provide and operate the relevant service. Depending on how someone uses the platform, this may include information needed to:

• provide fundraising and supporter services;
• process donations, purchases and other transactions;
• administer accounts and fundraising activities;
• process Gift Aid where applicable;
• communicate with users about services they have requested;
• provide customer support;
• prevent fraud, misuse and unauthorised access;
• meet legal, regulatory, tax and financial obligations; and
• protect the security and integrity of the platform.

Further information about how we process personal information, including lawful bases, retention periods and individual rights, is available in our Privacy Policy.

How we use and share data

People's Fundraising does not sell personal information.

We do not sell, on-sell, profile, mine or use organisations' private supporter information for PF's own marketing, advertising, commercial analytics or unrelated purposes. We store and handle it only to deliver, secure, maintain or support the organisation's configured service and documented instructions, or as required by law.

Information is disclosed only where needed to provide and secure authorised fundraising services, comply with documented instructions, support lawful transactions or meet legal obligations. Information PF processes independently as controller is handled for the limited lawful purposes explained in our Privacy Policy.

This may include sharing appropriate information with:

• payment processors and banking partners;
• the charitable organisation or fundraising organisation being supported;
• technology, infrastructure, email and security service providers;
• professional advisers where appropriate; and
• regulators, government bodies or law enforcement where required by law.

Where we use service providers to process organisation-controlled data for us, they act as authorised sub-processors under the Data Processing Schedule, with appropriate written contractual, technical and organisational safeguards. Providers acting independently as controllers are subject to their own legal obligations.

Data storage and international transfers

People's Fundraising's primary production infrastructure is hosted within the United Kingdom using the Amazon Web Services London region ( eu-west-2 ).

Some third-party technology and service providers may process limited personal information in the European Economic Area (EEA) or other countries as part of providing their services.

Where personal information is transferred outside the UK, we use appropriate safeguards required by UK data protection law. These may include UK adequacy regulations, approved contractual safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses, or another lawful transfer mechanism.

Platform resilience and monitoring

Fundraising can happen at any time, and we recognise the importance of keeping the platform available when charities, fundraisers and supporters need it.

People's Fundraising uses AWS cloud infrastructure designed to provide scalability, availability and operational resilience.

We use AWS monitoring, application monitoring, automated alerts and uptime monitoring to help identify performance, infrastructure, availability and security issues.

Our architecture allows platform capacity and infrastructure to be managed as usage changes, helping us support both normal fundraising activity and periods of increased demand.

Operational alerts are investigated by our technical team so that issues can be identified, assessed and addressed promptly.

Like all online services, no technology platform can guarantee uninterrupted availability. Our objective is to minimise disruption and restore normal service as quickly and safely as possible if an incident occurs.

Backups and recovery

Protecting fundraising and account information includes planning for unexpected events.

People's Fundraising uses multiple AWS backup and recovery mechanisms, including automated RDS backups, database snapshots and Amazon S3 versioning.

Backups are retained for a minimum of six months and for longer where required to meet legal, regulatory, tax, accounting or other statutory obligations.

These arrangements are designed to provide multiple recovery options in the event of a significant technical failure, data corruption or other incident.

Backup and recovery arrangements form part of our wider resilience processes and are reviewed as the platform, infrastructure and volume of fundraising activity develop.

When organisation-controlled personal data is due for return or deletion under the Organisation's instructions and the Data Processing Schedule, we apply the relevant return or deletion arrangements, subject to legal retention obligations. Residual copies awaiting protected backup expiry are restricted from routine use and removed as those backups expire or are replaced. Separately retained statutory records are subject to their own applicable retention rules.

Secure software development

People's Fundraising is actively developed and maintained by our technical team.

Security is considered throughout application development, testing and deployment rather than being treated as a separate feature added afterwards.

Our development practices include controls intended to protect against common web application risks, malicious automated activity, unauthorised access and inappropriate execution of browser content.

We regularly review our technology stack, application dependencies and third-party components, supported by vulnerability scanning, penetration testing and other security testing, so that identified risks and relevant security updates can be incorporated into the platform.

Security testing and vulnerability management

People's Fundraising maintains an active security testing and vulnerability management programme.

We carry out regular vulnerability scanning, penetration testing and other security testing designed to identify potential weaknesses in the platform and its supporting infrastructure.

We also keep operating environments, application components and third-party dependencies under review and apply relevant updates and security improvements as part of our ongoing development and maintenance processes.

Identified vulnerabilities are assessed according to their nature and potential risk and addressed accordingly.

Security testing is an ongoing process rather than a one-off activity, reflecting the fact that technologies, threats and security best practice continue to evolve.

Incident response

People's Fundraising maintains procedures to identify, investigate and respond to security incidents and personal data breaches.

If an incident occurs, our response may include:

• containing the incident and preventing further unauthorised access;
• investigating the cause, scope and potential impact;
• protecting affected systems and information;
• addressing identified vulnerabilities;
• documenting the incident and the actions taken; and
• notifying relevant controllers, individuals or authorities where required.

Organisation-controlled information: Where we become aware of a personal data breach affecting information held as processor for an organisation, we notify that organisation as Data Controller without undue delay and provide relevant information and assistance as required under the Data Processing Schedule. The organisation determines its own statutory reporting duties.

Information controlled by PF: Where PF is itself the controller, we assess whether the breach must be notified to the ICO and, if required, notify without undue delay and, where feasible, within 72 hours of becoming aware. We notify affected individuals without undue delay where required by law because of high risk to them.

Third-party services

Operating a modern fundraising platform requires carefully selected third-party technology and service providers.

These may provide services such as cloud infrastructure, payment processing, banking, email delivery, analytics, monitoring, fraud prevention and security.

Where a service provider acts as our sub-processor for organisation-controlled data, our Data Processing Schedule requires appropriate authorisation, equivalent written processor safeguards, information about proposed changes and responsibility for compliance. Other providers may act as independent controllers for their own limited processing activities. We assess relevant service providers and require appropriate contractual, technical and organisational protections.

We periodically review the services and technologies used by the platform as our requirements and the wider technology environment change.

Responsible fundraising

Technology security is only one part of operating a trusted fundraising platform.

People's Fundraising is registered with the Fundraising Regulator and is committed to fundraising that is legal, open, honest and respectful.

People's Fundraising is also registered with the Information Commissioner's Office and is committed to handling personal information responsibly and transparently.

We believe charities and supporters should have confidence both in the technology they use and in the organisation operating it.

Ongoing security

Security, data protection and resilience are ongoing responsibilities.

Technology, threats and good practice continue to evolve. We therefore continually review how People's Fundraising is developed, operated and protected.

This includes reviewing infrastructure, application security, access controls, data protection practices, third-party services, payment technology, monitoring, security testing and operational processes as the platform grows.

While no online service can be guaranteed to be completely secure, our objective is to maintain appropriate safeguards, respond quickly to issues and continually improve the security and resilience of the platform.

Further information

If your organisation is considering People's Fundraising and requires further information about our security, data protection, infrastructure or resilience arrangements, please contact us.

We are happy to provide additional information to charities, not-for-profits, partners and organisations carrying out technology, data-protection, security or procurement reviews.

Email: support@peoplesfundraising.com

For details of our controller/processor roles, please read our Privacy Policy. Contractual processor obligations appear in the Data Processing Schedule in our Terms and Conditions, with a concise overview on our Compliance & Trust page.