Security & Compliance
What we have in place today, and — just as plainly — what we don't.
Security Measures
- No SOC 2, ISO 27001, or any other security certification of our own.
- No external penetration test, and no bug bounty programme.
- No 24/7 monitoring, on-call rotation, or published uptime guarantee.
- No automated screening against sanctions or watch lists — reviews are done by hand.
- No public transparency ledger of individual transfers yet.
- No third-party audit of our privacy or financial controls.
If any of these is a requirement for you, email security@4planet.io and we will tell you exactly where we are.
Where our compliance stands
Data Protection
The site is served over TLS by Vercel, and the database is hosted by Supabase, which encrypts data at rest and manages the encryption keys. Payment card details are collected and stored by Stripe — they never reach our servers.
Access to user data is restricted by role, enforced at the database level with row-level security policies. Signing in to the admin panel requires a second factor (TOTP) in addition to a password. Administrative actions are written to our audit log.
We retain data only as long as necessary for business purposes and compliance requirements. Users can request data deletion at any time, subject to legal and regulatory requirements.
Audit Trail
Financial, signing, compliance and administrative actions are written to an audit log as they happen. Entries written through our audit helper store a SHA-256 hash of the entry before them, so a later edit to that chain is detectable rather than silent. A small number of internal admin tools still write unchained entries.
Entries include a timestamp, the acting user, the action type and relevant metadata, and are retained for seven years. They are readable by administrators, and by users for their own records. The chain covers the events listed above — it is not a log of every API request, and it is not published publicly.
How We Review Applications
Every partner and charity application lands in a review queue and is approved by a person on our team. That review covers:
- The organization's registration details, including its charity registration number where it has one
- The contact and role information given in the application
- Whether the applicant is entitled to act for the organization they are claiming
To be explicit: this is a manual review. We do not yet screen applicants automatically against sanctions or watch lists, and we do not re-screen approved organizations on a schedule. Integrating a screening provider is on our roadmap, and we will say so here when it is live.
Security FAQ
Traffic is served over TLS, and the database is managed by Supabase, which encrypts data at rest. Hosting is on Vercel. Both providers publish their own third-party audit reports; 4Planet itself has not been through a SOC 2 audit.
We build to PIPEDA for Canadian privacy, and tax receipts are generated in the format the Canada Revenue Agency requires for eligible registered charities. We hold no security or privacy certification of our own.
Applications go into a review queue. A person on our team checks the organization's registration details and the information supplied in the application before approving it. We do not yet run automated screening against sanctions lists.
We will notify affected users and the relevant privacy regulator as required, and will publish what we know. Our incident response process is written down internally but has not been externally tested.
Not yet — we have never commissioned an external penetration test, and we do not run 24/7 monitoring. Every change does run through automated checks in CI, including a row-level-security policy check and Supabase's security advisor, and admin access requires a second factor.
Yes, you can request data deletion at any time. Please contact us at security@4planet.io for assistance.
Security Questions?
If you have security concerns or questions, please contact our security team.