Security and your data

What we do today, in plain language.

What we store

Your email address, organization name, subrecipient list, the names you go by, decisions you record and your check records. Audit data comes from the public clearinghouse. The service doesn't load the names, phone numbers or emails of people that appear in its files. Separately, we may use the contact on an organization's public audit filing to tell it about the service, and we stop if asked.

How it's protected

• Connections are encrypted with HTTPS.
• Passwords are stored only as salted scrypt hashes, and sessions and API keys only as SHA-256 hashes, so a copy of the database can't be used to sign in.
• Sign-in attempts are rate-limited, and sign-in cookies can't be read by scripts or sent by other sites' forms.
• Each account can reach only its own list and records.
• We never see your card number. Paddle handles card payments.
• Accounts and records are backed up each time the service starts, and backups are kept for two weeks.

What we don't have

We're a small independent service. We don't have SOC 2, FedRAMP or similar certifications, single sign-on, or a guaranteed uptime commitment, and the service currently runs on a single computer. If your organization requires any of these, please ask before relying on it. Subrecipient lists are generally business information. Don't upload anything confidential that the service doesn't need, such as bank details or Social Security numbers.

What's sent elsewhere

To check an organization, we send its UEI to the clearinghouse's public API, without your name or account. See the privacy policy for everyone who handles data.

Report a problem

If you find a security problem, please tell us. If a breach affects your data, we'll tell you as the law requires.