When evaluating donation platforms, clients don’t ask the right questions, and vendors are counting on it.
As an enterprise executive, you need to dig deeper.
Here are five critical questions that will reveal whether your donation platform security truly protects your donors and your mission, rather than just promising to.
RED FLAG TO WATCH FOR: We're working toward PCI compliance.
Translation: We are currently processing your donors' payment data without meeting the security standards designed to protect it.

The Answer You Need
Yes, we have a valid PCI DSS certification (not in progress), and we run quarterly security scans, and we pass every scan. We can also provide an Attestation of Compliance (AOC) that you can verify.
RED FLAG TO WATCH FOR: Everyone gets admin access simply that way. When everyone has admin access, no one is accountable. Weak access controls mean a compromised account gives attackers the keys to your entire donation platform and your donors' data.

The Right Answer
We have Granular role-based access control (RBAC), and multi-factor authentication is required for all administrative functions.
We also offer the client access to review user permissions and activity logs and to audit who accessed what and when.
RED FLAG TO WATCH FOR: Fraud is really the payment processor's problem.
If an attack happens, and then days later, logs show that a testing attack processed thousands of fraudulent micro-transactions.
The vendor blamed the payment processor, without taking any responsibility to protect your mission.

What a Trustworthy Vendor Should Answer
We offer Multi-layered fraud prevention, form protection against automated submissions, high traffic protection and rate limiting, behavior tracking to identify suspicious patterns, and, of course, we never store card details, only tokenization.
In addition to CDN/Cloudflare with bot blocking and managed challenges.
We also provide real-time alerting when unusual patterns emerge. Donation platform fraud prevention is something not to be taken lightly.
RED FLAG TO WATCH FOR: Our multi-tenant architecture is more efficient and cost-effective.

The vendor is evading the question and trying to seduce you with a lower price instead, while failing to mention that choosing a multi-tenant SaaS donation platform means you share the risk with your neighbors.
Even if your platform is not the target of an attack, if any of the other tenants is attacked, you can be next as you are vulnerable too.
The Answer You Need
Assurance that you won’t be vulnerable if another tenant suffers an attack or a breach. In addition to proof of a solid isolation between tenants at the database, application, and infrastructure levels.
However, this answer is not possible with a multi-tenant SaaS option; you are better off owning an independent infrastructure without any noisy neighbors and shared risks.
RED FLAG TO WATCH FOR: Why would you want to host it yourself?

This classic answer from some vendors, while emphasizing the complexity of self-hosting, is not the assurance you need about data portability.
When a SaaS platform suffers a catastrophic breach, organizations get trapped: data export takes weeks, integrations break, and there's no fallback option.
What You Actually Need
A complete data export timeline, and better be in hours, not weeks, with a clear highlight of what’s included (data, code, configurations, integrations), the format of the exported data should be usable, not locked, and backup and independent failover options.
Organizations like UNHCR process $70M+ annually across 35+ markets on sovereign infrastructure built with open-source Drupal. They've chosen ownership over promises.
When you own your infrastructure and an unusual donation pattern happens:
When a card testing attack attempts fraudulent transactions:
When downtime threatens during crisis fundraising:
When vetting your donation platform provider, to ensure the donation platform's security is appropriate, always ask the questions that will shed light on the level of security they can offer.
Be very specific and ask detailed questions about compliance, fraud prevention, access controls, data portability, and the level of safety in a multi-tenant setting.
You need to ensure the protection of your donors’ data and your entire mission.
The Drupal donation platform has the right answer to all of your questions, and Vardot has the legacy to ease all your concerns.