Your data is yours. Your privacy is protected. Your platform is audited.
Foundations, boards, and auditors recognize what you're on. SOC 2 Type II in progress, GDPR & CCPA compliant, WCAG 2.1 AA enforced, HIPAA-ready architecture, PCI DSS certified for donations. Every layer documented, every claim verifiable.
What auditors and foundations expect to see.
Six certifications, every one documented. Click through for evidence packs, audit letters, and compliance reports.
Continuous evidence collection started day one. Trust services criteria covered: Security, Availability, Confidentiality, Processing Integrity, Privacy. Audit firm engaged.
Request evidence pack →Lawful basis documented per processing activity. Data subject rights: access, rectification, erasure, portability, restriction, objection. EU representative appointed.
View our DPA →"Do Not Sell or Share My Personal Information" link enforced platform-wide. Consumer rights honored within 45 days. Verifiable consumer requests handled via privacy portal.
Read privacy policy →Enforced at the editor level — color contrast, alt text, keyboard navigation, screen reader compatibility, focus indicators. axe-core CI checks on every deploy.
Request accessibility report →Architecture supports BAA execution for healthcare-adjacent organizations. Field-level PHI encryption, audit logging, access controls, automatic session timeout available.
Request BAA →SAQ-A scope via Stripe Elements. We never see, store, or transmit raw card data. Tokenization handled by Stripe. Quarterly ASV scans by third-party.
View attestation →Your data is yours.
Not ours, not anybody's.
Five non-negotiable commitments, written into our DPA, enforceable in Michigan court.
Never sold
We don't sell your donor list, your member directory, your customer data — to anyone, ever.
Never shared
Not with marketing partners, not with affiliates, not with our other customers. Walled.
Never trained on
We don't train AI models on your data. Your private content stays private — period.
Always exportable
One-click export to CSV, JSON, or SQL dump. Your entire dataset, on demand, no questions asked.
Deleted on request
Within 30 days of cancellation. Permanently. Hot storage immediately, cold storage purged at day 30.
"Twenty-five years in business taught us one thing about data: the moment a vendor sells your customers' information, the relationship is over."
"We don't sell data. We don't share data. We don't train AI on data. We host it in the United States, encrypt it with AES-256, and give you a one-click export anytime you want."
"That's the deal. Always was. Always will be."
Eight layers of defense.
From perimeter to database, each layer documented, hardened, and continuously monitored.
Every vendor that touches your data.
Total transparency. We update this list within 30 days of any change.
If something goes wrong, we tell you.
SLAs measured in minutes, not days. Plans rehearsed quarterly.
We detect issues before you do.
Real-time monitoring on every service. PagerDuty alerts on-call engineers within 60 seconds of an anomaly. Status page updates within 15 minutes of a confirmed incident.
- Critical (P0) acknowledgment≤ 15 min
- High (P1) acknowledgment≤ 30 min
- Status page update≤ 15 min
- Customer notification (P0)≤ 60 min
If your data is breached, you'll know within 72 hours.
GDPR mandates 72-hour breach notification. We honor that for every customer, regardless of jurisdiction. You get a detailed incident report with: scope, timeline, affected data, remediation, prevention.
- Initial notification≤ 72 hrs
- Detailed incident report≤ 7 days
- Post-mortem (public)≤ 14 days
- Remediation evidence≤ 30 days
The trust honest FAQ.
Where is my data physically stored?
What happens to my data if BizTechMgt goes out of business?
Do you have a Business Associate Agreement (BAA) for HIPAA?
Can I get a SOC 2 evidence pack before you're certified?
Do you train AI on my content or my donors' data?
What's your uptime track record?
Trust isn't claimed.
It's documented.
Need our trust pack for a board review? A foundation due diligence? An auditor's evidence request? Tell us what you need — we'll send it.