Skip to main content
BackedHelp Centre

Security and privacy review

What Backed gives your security and privacy reviewers during onboarding, and the settings and records they will want to see.

Last updated

If your organisation reviews a new system before it goes live, such as an IT security review, a privacy impact assessment or procurement checks, Backed supports it as part of onboarding. Tell your onboarding contact who your reviewer is and what they need, ideally in your first planning call, so the review is finished before go-live.

What your onboarding contact sends

  • The security pack: the documents a security reviewer asks for.
  • The data-sovereignty statement: who can see your data and how access is controlled, where your data is processed, and what you can take out of Backed.

Each request and each delivery is recorded on Settings > Onboarding, under Security and privacy review, with the date it was requested and the date it was delivered. See Onboarding sessions.

Backed's legal documents are published in its Legal Centre, at backed.giving/legal, each version at its own address:

  • the Terms of Use, the Privacy Policy and the Data Processing Agreement. A document still being prepared says so;
  • Cookies: every cookie a Backed site sets, and why;
  • the Privacy compliance statement: how Backed meets each Australian and New Zealand privacy principle, and the evidence for each;
  • Subprocessors: the service providers that process data for Backed, and their countries. Your organisation's owners are emailed at least 30 days before a subprocessor is added or changed, and an Administrator can object under Settings > Privacy.

Settings your reviewer will ask about

  • Where your data lives. On Settings > Profile and terms, the Hosting and data protection panel shows your hosting region and, for each service, its provider and region. Regions not yet confirmed in a provider's console say Assumed, to be confirmed. See Organisation settings.
  • Two-factor authentication. On Settings > Security, require it for everyone or for chosen roles, with a grace period. See Security settings.
  • Single sign-on. On Settings > Profile and terms, the SSO tab connects your identity provider over SAML 2.0 or OpenID Connect, and SSO-only mode makes it the only way in. See Single sign-on.
  • Who can do what. Each Administrator holds named permissions, set on People > Administrators; each person sees their own on the My access tab of Your account. See Administrators and permissions.
  • The audit log. Settings > Audit log lists every recorded change, by whom and when. Entries cannot be changed or deleted. See Audit log.
  • Log streaming. Settings > Security shows whether logs and audit entries are streamed to your security team's collector.
  • Privacy requests. Settings > Privacy records each request from a person about their information, with its due date, the identity check and the decision, and exports or erases the person's information. See Privacy requests.
  • Reporting a breach. Report a suspected data breach on Settings > Security sends a report to Backed's security team. If a breach affecting your organisation is confirmed, your owners and the Administrators who manage organisation settings are emailed within 24 hours of it being verified.

See also

This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.