Requesting the security pack

The security pack is the set of documents a security, procurement or privacy reviewer asks for when they assess Backed as a supplier, in one dated download. Anyone can request it from Backed's public trust page, at backed.giving/trust: your own security team, a funder you report to, or an auditor. It is shared under non-disclosure terms the requester accepts when they ask.

What the pack holds

• The control map, as a spreadsheet (CSV) and as a document: each security control, the requirement it meets, who owns it and the tests that prove it.
• The policies: the security statement (the trust page's facts on encryption, where data is kept and how each store is protected, testing, assurance and availability), the vulnerability disclosure policy, the Privacy Policy in force and the privacy compliance statement.
• The Data Processing Agreement, once it is published. Until then the pack says it has not been published yet.
• The subprocessors, from the register in the Legal Centre, with the country each processes in.
• Residency: where each store is kept and where each part of the platform runs, with how each store is protected.
• The penetration-testing summary: how often Backed is independently tested and the last test. No independent test has been performed yet, and the summary says so.
• Two pre-answered questionnaires: CAIQ-Lite and an NZISM mapping. Both are Backed's own self-assessment; neither is a certification or an independent audit.

Each pack is dated, and it names the version of the platform it was built from and the date its facts were last reviewed, so a reviewer knows exactly what it describes. It holds no tenant data: nothing your organisation, your applicants or your team have entered is in it.

How to request it

1. Go to backed.giving/trust and find Request the security pack, under Assurance.
2. Enter Your name, Organisation and Work email.
3. Read the terms: use the pack only to assess Backed as a supplier, share it only with the people in your organisation who need it for that, do not publish it or pass it on, and destroy every copy when the assessment ends.
4. Tick I accept these terms on behalf of my organisation., then select Request the security pack.

An acknowledgement is emailed to the address given. If the same address asks again within a day, the second request answers with the first, and nothing new is sent: check your inbox for the first email.

What happens next

Someone at Backed reviews each request, normally within five business days.

• If it is approved, the requester is emailed a link to download the pack. The link works for fourteen days and downloads one dated ZIP file. After that it stops working, and the requester can ask again from the trust page. If the email goes missing, write to security@backed.giving and Backed can resend the link: that sends a fresh link, good for another fourteen days, and the link sent before stops working.
• If it is refused, the requester is emailed to say so, with the reason when one is given.

Each request, its decision, who made it and when, and every download are recorded by Backed.

The review period

The pack is current for twelve months from the trust page's last-reviewed date. Once that period has passed, the pack is not issued until it has been reviewed again. A request can still be made, but it is not approved, and no link is sent, while the pack is under review. A link sent before the period passed opens a page saying the pack is under review until it has been reviewed again.

Questions

Write to security@backed.giving with any question about the pack or about Backed's security. To report a vulnerability, follow the disclosure policy described in The public trust page.

If your organisation is reviewing Backed during onboarding, your onboarding contact can also send the pack and record it for you. See Security and privacy review.

See also

• The public trust page
• Security and privacy review
• Getting help