Your organization's records are kept separate
Everything you enter is stored under your organization. Before the platform returns any record, it checks that the person asking belongs to that organization and has the access to see it. One organization never sees another's donors, members, finances or documents.
You decide who sees what
- The owner and Admins invite people and choose what each person can do. A Viewer can read but not change anything.
- A consultant or specialist you invite holds a seat you control: a specialist sees only the modules you tick, and either can be removed at any time.
- Case Management records are refused to anyone without access to Case Management, and a confidential case note never leaves the platform, through the integration API or anywhere else.
- The activity log on My Organization records who joined, who was given access to what, and the changes consultants and specialists save, each with the person's name.
Signing in without passwords
You sign in with your Google account or with a one-time sign-in link sent to your email address. No passwords are stored on our servers, so there are none to steal. Every page and every connection uses an encrypted connection (HTTPS).
Payments stay with Stripe and PayPal
Your subscription, and the payments your organization takes through the platform, are made on Stripe's or PayPal's own checkout pages. Card and bank numbers go to them directly and never reach our servers.
Connections you choose to make to outside services (QuickBooks Online, or your bank through Plaid) use access tokens that are encrypted before they are stored and never sent to a web browser. Connecting a bank asks the owner or admin for the six-digit code we email them first, so a signed-in session alone cannot connect one; we never see your online banking password, which you enter on Plaid's own screen. Disconnecting revokes the connection with the service and deletes the stored token at once.
Backups
The platform's databases are exported every week, and the copies are kept on separate storage, so your records can be recovered if something goes wrong.
If you leave
The owner can close the organization from My Organization. Everyone loses access straight away. For fourteen days the records can be restored, in case it was a mistake. After that they are deleted.
A few kinds of record are kept after that, because an organization may need them later for its own legal and tax purposes: financial transactions, signed e-signature records, support conversations and the activity log.
What not to store here
All In One Nonprofit is not built for health records. We do not accept protected health information under HIPAA and do not sign business associate agreements, so please do not keep medical or health records on the platform.
Two more things said plainly. We do not hold a SOC 2 report or any other third-party security certification; what we do is described on this page, and a funder or auditor who needs a certification should know that before your organization relies on us. And the platform is not built for children: accounts are for adults acting for an organization, we do not knowingly collect personal information from anyone under 13, and a youth program should record what it needs about a child without creating an account for the child.
More detail
The Privacy Policy and Terms of Service are the formal documents. For a question this page does not answer, write to [email protected] or call (561) 203-6142.
All In One Nonprofit is the trade name of A Step Ahead Media, LLC. Read more about the company and its founder.