Security and Data Protection

Charity OS stores your data on Supabase infrastructure located in the European Union, in the eu-central region (Frankfurt, Germany). The application is served by Vercel at charityos.ai.

All traffic between your browser and the platform is encrypted in transit using TLS (HTTPS). Data at rest is encrypted by Supabase using AES-256.

Every database table is protected by PostgreSQL Row Level Security, scoped by organization identifier. Enforcement happens inside the database itself, independent of application code, so one organization's records cannot be returned to another organization.

These policies are covered by an automated pgTAP test suite that runs in continuous integration, so tenant isolation is verified on every change to the codebase.

When your team runs a sanctions screening, the searched name and entity attributes are sent to OpenSanctions (yente API) for matching. Only the data needed to perform the search is transmitted; the rest of your records stay on the platform.

Screening results are stored with full audit fields: reviewer, decision, written reason, and timestamp.

Every screening decision requires a written reason and is recorded together with the reviewer's identity and a timestamp. There are no anonymous or unexplained decisions.

Periodic rescreening can be scheduled weekly, monthly, or quarterly per organization. It only flags new or changed matches for human review; it never decides on a match automatically.

Database backups are managed by Supabase as part of its automated backup service.

Beyond technical controls, we treat data about beneficiaries and communities as a responsibility. We use the IASC Operational Guidance on Data Responsibility in Humanitarian Action as guiding principles for how data should be collected, processed, and shared in humanitarian and charitable contexts.

In practice, the platform's existing safeguards map to that guidance: data is hosted in the European Union, PostgreSQL Row Level Security keeps each organization's records isolated inside the database itself, and the screening flow transmits only the minimum data needed to perform a search. These are alignment measures, not a certification; the guidance itself remains the reference for how humanitarian data should be handled.

If you believe you have found a security vulnerability in Charity OS, please report it to security@charityos.ai and include enough detail for us to reproduce the issue. We ask that you allow us reasonable time to investigate and remediate before any public disclosure, and we acknowledge legitimate reports.