> This is the Markdown of a Backed Help Centre page, https://admin.backed.giving/help/administrator/getting-started/public-trust-page.md. Every page is listed at https://admin.backed.giving/help/llms.txt.

> This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.

If a funder, an auditor or your own security team asks how Backed looks after your organisation's
data, start them at Backed's trust page, at backed.giving/trust. It is public, so they can read it
without an account, and it answers the first questions a risk or procurement team asks in terms they
can check.

## What the trust page shows

- **Last reviewed.** The date the page and its facts were last reviewed, at the top of the page.
- **Encryption.** In transit: every public Backed address accepts TLS 1.2 and TLS 1.3 only, plain
  HTTP is redirected to HTTPS, and browsers are told to use HTTPS only. At rest: the database, its
  backups and stored files are encrypted by their providers (AES-256), and each organisation's
  integration tokens and webhook secrets are sealed again inside Backed under that organisation's
  own key. Bank account numbers and Field Review values are sealed inside Backed too.
- **Where data is kept.** Each store (the database, backups, file storage, email delivery, logs and
  error tracking) with its provider, its region and how it is protected at rest and in transit. A
  region not yet confirmed in a provider's console says so.
- **Where data is processed.** Each part of the platform, such as sign-in, the portals and
  background jobs, with its provider and region. Some processing and mail delivery happen outside
  Australia, and the page says which.
- **Subprocessors.** The service providers that process data for Backed, with what each does and
  its country, read from the register in the Legal Centre at backed.giving/legal.
- **Independent testing.** How often Backed is independently tested, and the date of the last
  test. No independent penetration test has been performed yet, so the page says the first is
  planned rather than showing a date.
- **Assurance.** Where Backed's assurance programme stands: a SOC 2 Type II programme is being
  prepared and no report has been issued. Backed claims no certification it does not hold; its
  controls are mapped to SOC 2, ISO 27001 and the Australian ISM.
- **Controls we cite.** A short list of the security controls behind these statements, each by its
  control number, such as the server-side check of every signed-in request and the separation of
  one organisation's records from another's.
- **Availability.** Backed's internal availability objective, in words. It is an engineering
  objective, not a contractual commitment, so the page gives no percentage. It links the status
  page, which shows how the platform is running now and over the last 90 days.
- **Report a vulnerability.** The address to write to, security@backed.giving, and a link to the
  disclosure policy.

## The disclosure policy and security.txt

The disclosure policy, at backed.giving/security/disclosure, tells a security researcher what is in
scope (backed.giving and every address under it, including your organisation's own portal address,
and the Backed API), what is out of scope, the safe harbour Backed offers for research done in good
faith, and how quickly Backed responds: a report is acknowledged within 2 business days and triaged within
5, and the researcher is kept told until it is resolved. Backed does not run a paid bounty
programme.

Every Backed address, your organisation's portal address included, publishes a `security.txt` file
at `/.well-known/security.txt`, the standard place researchers look for where to report an issue. It
names the contact address, the disclosure policy and the date the file expires.

## How the page is kept current

The page is reviewed at least once every twelve months and after any change to where Backed hosts
data. Backed's build fails if the review is more than twelve months old, or if `security.txt` is
within 30 days of expiring, so neither can quietly go out of date.

## Asking for more

When a reviewer needs more than the page, they can request the security pack from the trust page
itself: the control map, the policies, the subprocessors, residency, the penetration-testing
summary and two pre-answered questionnaires, in one dated download. See
[Requesting the security pack](security-pack-request.md).

## See also

- [Requesting the security pack](security-pack-request.md)
- [Security and privacy review](security-and-privacy-review.md)
- [Getting help](getting-help.md)