Donor data security and PCI compliance

Cyber security, built in

The protection of our clients' and donors' information is our utmost priority. We run a 360-degree monitoring and management process that combines internal protocols with current cyber protection software, and our IT service providers monitor and safeguard all data and systems 24/7.

That lets charities focus on their work without worrying about data breaches or cyber attacks.

Preparation

Our IT service providers prepare for threats before they happen through:

• Security and risk assessment
• Information security strategy
• Security policy development and review
• Secure network design and architecture

Protection

Client data is protected from current and future attacks through:

• Identity and access management
• Privileged account management
• Database encryption
• Public key infrastructure (PKI)
• Secure cloud storage
• Threat and vulnerability assessment
• Penetration testing and web application testing
• Multi-factor authentication

Response

If an incident occurs, a timely response limits the damage. Our IT service providers provide:

• Incident response
• Digital forensics
• Forensic investigation

Platforms and data retention

ARC Twenty Two uses the AVI8 and Evergiving platforms to perform verification contacts. Both are Level 1 PCI-certified. All personal data and recorded contacts are de-identified or deleted after six months.

We use Indigo8's Oper8 platform to process data. All data is securely encrypted, and personal information is automatically de-identified after six months.

Our team follows our PCI DSS responsibilities and PCI mobile device standards whenever payment card information is handled.