NGO Analytics

    Security at NGO Analytics

    How we protect customer data across Grant Ops and Fiscal Sponsor OS — roles and row-level security, MFA, encryption in transit and at rest, audit logging, and our subprocessors.

    SOC 2 preparation

    NGO Analytics is preparing for a SOC 2 Type II examination covering Security, Availability, and Confidentiality. We are not yet certified.

    Our production system boundary covers the Grant Ops and Fiscal Sponsor OS applications, hosted on Supabase (Auth, Postgres, Storage) and DigitalOcean App Platform. The DPA and subprocessor list below name every vendor that can access customer content.

    Need a DPA, the subprocessor list, or a security questionnaire? Email security@ngoanalytics.com or see our Data Processing Addendum and subprocessor list.

    System boundary

    • Grant Ops and Fiscal Sponsor OS are separate applications with separate logins, running on the same managed infrastructure.
    • Production data lives in Supabase (Auth, Postgres, Storage). Application hosting runs on DigitalOcean App Platform.
    • This marketing site (ngoanalytics.com) is a public content site and holds no customer grant or sponsorship records.

    Controls in product today

    • Role-based access control with row-level security on customer tables.
    • Multi-factor authentication available on accounts, plus leaked-password checks at sign-up.
    • Encryption in transit (TLS) and at rest for database and file storage.
    • Audit logging of key record changes, retained for review.
    • Least-privilege service credentials, rotated on staff change.

    Hosting and subprocessors

    • Supabase — authentication, database, and file storage.
    • DigitalOcean — application hosting.
    • Stripe — billing and payment processing.
    • Email delivery for transactional and notification mail.
    • The full, current list is on our subprocessors page and in the signed DPA.

    What we will not say

    • We are preparing for SOC 2 Type II. We are not certified, and we do not describe ourselves as SOC 2 certified or SOC 2 compliant.
    • We do not claim controls we have not implemented. If a questionnaire asks for something we do not have, we say so.

    Questions from your security team?

    We answer vendor questionnaires and share our current documentation on request.

    Email security@ngoanalytics.com

    What we tell funders and boards

    Same terms as the signed DPA and order form. See subprocessors.

    • Customer content is not used to train NGO Analytics or any third-party model.
    • No new AI vendor without updating /subprocessors.
    • Optional LLM only under an API agreement that prohibits training and uses zero data retention where the vendor offers it.
    • Consumer ChatGPT / Claude.ai are not subprocessors.