Security

• Every connection to Capvera is encrypted with TLS. The database and its backups are encrypted at rest by our database provider.
• Applicants’ dates of birth and home addresses are encrypted again, by us, with AES-256-GCM, and kept apart from the rest of the application so they can be deleted on their own, earlier schedule.
• Where we keep a code made from an identifying detail, it is a keyed one-way hash (HMAC), not the detail itself.
• Each charity’s data is tied to that charity in the database itself, so one charity’s staff cannot reach another’s records.
• The application connects to the database with separate roles that hold only the permissions they need.

Staff sign in with Google or Microsoft. We hold no passwords. A signed-in session is a random token in a cookie, and we store only a hash of it, so a copy of our database cannot be used to sign in.

The service and its database run in Northern Virginia, in the United States. The database can be restored to any point in the last seven days, and nothing older is kept.

If you think you have found a security problem, write to customer_support@capvera.co. We will reply, and we ask that you give us a reasonable time to fix it before telling anyone else.