The 5 Donation Platform Security Questions Your Vendor Hopes You Never Ask

When evaluating donation platforms, clients don’t ask the right questions, and vendors are counting on it.

As an enterprise executive, you need to dig deeper.

Here are five critical questions that will reveal whether your donation platform security truly protects your donors and your mission, rather than just promising to.

Donation Platform Security Questions to Ask Your Vendor

1| Are you actually PCI compliant today?

RED FLAG TO WATCH FOR: We're working toward PCI compliance.

Translation: We are currently processing your donors' payment data without meeting the security standards designed to protect it.

Image

The Answer You Need

Yes, we have a valid PCI DSS certification (not in progress), and we run quarterly security scans, and we pass every scan. We can also provide an Attestation of Compliance (AOC) that you can verify.
 

2| What level of access does each user have?

RED FLAG TO WATCH FOR: Everyone gets admin access simply that way. When everyone has admin access, no one is accountable. Weak access controls mean a compromised account gives attackers the keys to your entire donation platform and your donors' data.

Image

The Right Answer

We have Granular role-based access control (RBAC), and multi-factor authentication is required for all administrative functions.

We also offer the client access to review user permissions and activity logs and to audit who accessed what and when.

3| What is your fraud prevention strategy beyond the payment gateway?

RED FLAG TO WATCH FOR: Fraud is really the payment processor's problem.

If an attack happens, and then days later, logs show that a testing attack processed thousands of fraudulent micro-transactions.

The vendor blamed the payment processor, without taking any responsibility to protect your mission.

Image

What a Trustworthy Vendor Should Answer

We offer Multi-layered fraud prevention, form protection against automated submissions, high traffic protection and rate limiting, behavior tracking to identify suspicious patterns, and, of course, we never store card details, only tokenization.

In addition to CDN/Cloudflare with bot blocking and managed challenges.

We also provide real-time alerting when unusual patterns emerge. Donation platform fraud prevention is something not to be taken lightly.

4| How safe is the multi-tenant architecture you are offering?

RED FLAG TO WATCH FOR: Our multi-tenant architecture is more efficient and cost-effective. 

Image

The vendor is evading the question and trying to seduce you with a lower price instead, while failing to mention that choosing a multi-tenant SaaS donation platform means you share the risk with your neighbors.

Even if your platform is not the target of an attack, if any of the other tenants is attacked, you can be next as you are vulnerable too.

The Answer You Need

Assurance that you won’t be vulnerable if another tenant suffers an attack or a breach. In addition to proof of a solid isolation between tenants at the database, application, and infrastructure levels.

However, this answer is not possible with a multi-tenant SaaS option; you are better off owning an independent infrastructure without any noisy neighbors and shared risks.

5| What happens to my data if I decide to leave your platform?

RED FLAG TO WATCH FOR: Why would you want to host it yourself?

Image

This classic answer from some vendors, while emphasizing the complexity of self-hosting, is not the assurance you need about data portability.

When a SaaS platform suffers a catastrophic breach, organizations get trapped: data export takes weeks, integrations break, and there's no fallback option.

What You Actually Need

A complete data export timeline, and better be in hours, not weeks, with a clear highlight of what’s included (data, code, configurations, integrations), the format of the exported data should be usable, not locked, and backup and independent failover options.

 

Donation Platform Security in Open-Source Platforms Built on Drupal
 

Organizations like UNHCR process $70M+ annually across 35+ markets on sovereign infrastructure built with open-source Drupal. They've chosen ownership over promises.

When you own your infrastructure and an unusual donation pattern happens:

• Your team sees the threat in real-time
• You access raw logs immediately
• You act without waiting for approvals

When a card testing attack attempts fraudulent transactions:

• Form protection blocks suspicious submissions
• Behavior tracking identifies and stops bot patterns
• CDN/Cloudflare challenges automated attacks

When downtime threatens during crisis fundraising:

• Multiple servers ensure one failure doesn't bring down your entire platform
• You scale independently based on your traffic patterns
• Your 99.99% uptime isn't a vendor promise's your infrastructure reality
   

Moving Forward

When vetting your donation platform provider, to ensure the donation platform's security is appropriate, always ask the questions that will shed light on the level of security they can offer.

Be very specific and ask detailed questions about compliance, fraud prevention, access controls, data portability, and the level of safety in a multi-tenant setting.

You need to ensure the protection of your donors’ data and your entire mission.

The Drupal donation platform has the right answer to all of your questions, and Vardot has the legacy to ease all your concerns.