Security & privacy

501 Compass is built for nonprofit organizations handling donor, volunteer, and board data. This page summarizes our technical controls.

Data isolation

Each organization's data is isolated with Postgres row-level security (RLS) on every tenant table. Staff access is scoped to organizations they belong to.

Authentication

Passwords are hashed with scrypt. Sessions use opaque HttpOnly cookies; session tokens are stored as SHA-256 hashes in the database. Optional Google sign-in links to existing accounts by verified email.

Encryption & transport

All traffic is served over HTTPS/TLS. Database connections use SSL in production. Payment card data is never stored — giving uses hosted checkout (Stripe, PayPal, etc.).

Audit logging

Key actions write to an org-scoped activity log exportable by administrators. Super-admin actions are logged separately.

Subprocessors

Railway — application hosting & Postgres
Resend — transactional email
Stripe — org billing & donor payments (when enabled)
Amazon S3 (optional) — document storage

Questions? Contact your organization administrator or [email protected].