Skip to main content
BackedHelp Centre

The public trust page

What Backed's public trust page at backed.giving/trust tells your funders, auditors and security reviewers, and how it is kept current.

Last updated

If a funder, an auditor or your own security team asks how Backed looks after your organisation's data, start them at Backed's trust page, at backed.giving/trust. It is public, so they can read it without an account, and it answers the first questions a risk or procurement team asks in terms they can check.

What the trust page shows

  • Last reviewed. The date the page and its facts were last reviewed, at the top of the page.
  • Encryption. In transit: every public Backed address accepts TLS 1.2 and TLS 1.3 only, plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only. At rest: the database, its backups and stored files are encrypted by their providers (AES-256), and each organisation's integration tokens and webhook secrets are sealed again inside Backed under that organisation's own key. Bank account numbers and Field Review values are sealed inside Backed too.
  • Where data is kept. Each store (the database, backups, file storage, email delivery, logs and error tracking) with its provider, its region and how it is protected at rest and in transit. A region not yet confirmed in a provider's console says so.
  • Where data is processed. Each part of the platform, such as sign-in, the portals and background jobs, with its provider and region. Some processing and mail delivery happen outside Australia, and the page says which.
  • Subprocessors. The service providers that process data for Backed, with what each does and its country, read from the register in the Legal Centre at backed.giving/legal.
  • Independent testing. How often Backed is independently tested, and the date of the last test. No independent penetration test has been performed yet, so the page says the first is planned rather than showing a date.
  • Assurance. Where Backed's assurance programme stands: a SOC 2 Type II programme is being prepared and no report has been issued. Backed claims no certification it does not hold; its controls are mapped to SOC 2, ISO 27001 and the Australian ISM.
  • Controls we cite. A short list of the security controls behind these statements, each by its control number, such as the server-side check of every signed-in request and the separation of one organisation's records from another's.
  • Availability. Backed's internal availability objective, in words. It is an engineering objective, not a contractual commitment, so the page gives no percentage. It links the status page, which shows how the platform is running now and over the last 90 days.
  • Report a vulnerability. The address to write to, security@backed.giving, and a link to the disclosure policy.

The disclosure policy and security.txt

The disclosure policy, at backed.giving/security/disclosure, tells a security researcher what is in scope (backed.giving and every address under it, including your organisation's own portal address, and the Backed API), what is out of scope, the safe harbour Backed offers for research done in good faith, and how quickly Backed responds: a report is acknowledged within 2 business days and triaged within 5, and the researcher is kept told until it is resolved. Backed does not run a paid bounty programme.

Every Backed address, your organisation's portal address included, publishes a security.txt file at /.well-known/security.txt, the standard place researchers look for where to report an issue. It names the contact address, the disclosure policy and the date the file expires.

How the page is kept current

The page is reviewed at least once every twelve months and after any change to where Backed hosts data. Backed's build fails if the review is more than twelve months old, or if security.txt is within 30 days of expiring, so neither can quietly go out of date.

Asking for more

When a reviewer needs more than the page, they can request the security pack from the trust page itself: the control map, the policies, the subprocessors, residency, the penetration-testing summary and two pre-answered questionnaires, in one dated download. See Requesting the security pack.

See also

This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.