Pledgix

בסייעתא דשמיא

Trust Center

Your donors trust you.
Verify us.

Everything about how Pledgix secures, moves, records, and - if you ever choose - returns your data. Written from the actual system, not from a brochure - and where an industry certification is still ahead of us, we say so plainly instead of implying it.

Application security

Locked by default. Verified on every request.

Hardened at the edge

Every API response ships a strict Content-Security-Policy (no inline scripts), HSTS with preload, and clamped frame-ancestors. If the security middleware ever fails to load in production, the server refuses to start - security is not allowed to silently degrade.

Identity, verified cryptographically

Sign-in runs on Supabase Auth. Every API request carries a JWT that the server verifies against Supabase's published signing keys - issuer and audience checked on every call. Sensitive administrative actions demand a second factor: the request is rejected unless the session was elevated with MFA. The admin console also signs idle sessions out after 15 minutes.

Three layers of access control

Role permissions, per-campaign membership, and row-level data scoping - applied together on every query. The scoping layer fails closed: an account with no explicit rule for a data type gets nothing, not everything. A campaign you can't access is indistinguishable from one that doesn't exist.

Secrets encrypted before they're stored

Stored payment credentials and integration tokens (QuickBooks, Slack, HubSpot, Google) are encrypted with AES-256-GCM at the application layer before they ever reach the database - a database read alone cannot expose them.

Inbound and outbound, both guarded

Every payment and integration webhook we receive is signature-verified with timing-safe comparison before it's processed. Every webhook we send on your behalf passes an SSRF guard: HTTPS-only, private and internal network ranges blocked, and the destination re-resolved at send time to defeat DNS tricks.

Rate-limited by real identity

API traffic is rate-limited per client using the infrastructure-verified address - not spoofable request headers. Login and other sensitive endpoints carry much stricter limits than the general API.

Found something? Write to contact@pledgix.com with "Security" in the subject line - it reaches the team that owns the code, and we respond fast. Researchers acting in good faith are welcomed, not threatened.

Payment data

Card numbers never touch Pledgix servers.

This is the sentence that matters most on this page, so let's be precise about it.

When a donor types a card number into a donation page, it goes into secure fields served by our payment processor and comes back to us only as a single-use token. The charge is made with the token. Our database stores the result and masked metadata - never the card number.

When a donor gives by phone, the card is captured by the telephony provider's certified payment capture (Twilio Pay) and tokenized before our systems see anything. When a donor taps a card on a terminal, the dedicated device talks to the processor - Pledgix receives the outcome of the charge, not the card.

Donation funds are charged by regulated payment processors and settle to the receiving side directly: Pro campaigns connect their own gateway accounts (Stripe or Sola), and Pledgix One donations settle to the sponsoring 501(c)(3). Donation money does not sit in a Pledgix bank account.

Charges that can't double

Every donation carries a single-use idempotency key that follows it through the processor - a network retry or a double-click cannot become a double charge.

Anonymous means anonymous

Anonymous giving is enforced end-to-end: anonymous donors never appear on public pages, sponsor listings, or team boards - the platform forces the display name, it doesn't just hide a field.

Where certification stands

Card data is handled end to end by PCI DSS-certified payment processors - the same infrastructure that carries a large share of the world's online payments. Pledgix's side of the architecture is deliberately built so card numbers never enter our systems at all, which is the strongest PCI posture there is: the safest place to keep a card number is nowhere.
Reliability

Built for the four loudest hours of your year.

Watched, not assumed

Health checks run on every layer of the platform - the API, the payment webhooks, the telephony bridge - and the worker fleet is supervised continuously, so a stalled job is restarted, not discovered. We deliberately don't quote an uptime percentage here: a self-reported number you can't check is marketing, not reliability. What we build for instead is the only test that matters - your campaign night.

Nothing important runs once

Receipts, reconciliation, recurring charges, and integrations run on a supervised worker fleet with leases, retries, and escalation ladders. A failed receipt email retries on a schedule; a declined recurring charge follows a configured retry ladder; reconciliation re-checks campaign money against processor records on a loop.

Where the data lives

The database runs on managed Postgres infrastructure with provider-managed backups - we don't run databases on hand-built servers in a closet. Sensitive artifacts like donation receipts live in private storage buckets, and stored secrets are encrypted at the application layer on top of that - so even a copy of the database alone cannot expose a credential.

Campaign-night surge is the design point

Live totals, big-screen displays, phone rooms, and terminals all feed one ledger built to be hammered at once - because our customers' biggest night is precisely when software usually embarrasses itself.
Data portability

Your data is yours. Leaving should be easy - that's why you'll stay.

Almost no platform in this industry dares to publish an exit page. Here is ours.

Today, from inside the product, you can export campaign reports as CSV, Excel, or PDF; donor and donation histories; linked matched-donation records; consent logs; invoices and receipts as PDF - no support ticket, no waiting period, no export fee.

If you decide to leave, your donor relationships leave with you. Export everything yourself before closing the account, or ask us and we'll prepare a complete export package. After closure, we keep only what financial and legal record-keeping genuinely requires - transaction records, tax receipts, the consent log - and nothing more.

And there is no exit toll. No export fee, no data ransom, no "we'll get to it next quarter." Leaving is a decision, not a negotiation - we'd rather earn next year's campaign than lock in last year's.

Exports that exist today

Campaign reports (CSV/XLSX/PDF) · donor & donation exports · matched-donation CSV · consent-log CSV · invoices & tax receipts (PDF) · donor call sheets (PDF). All self-serve.

Retention is deliberate

Operational logs purge on schedules (email logs daily past their window, integration queues at 30-90 days, receipts per a configurable retention period) - we keep what's needed for your books and your audits, not everything forever.

The hard question, answered honestly

What happens to recurring donations if you leave? On Pro, recurring schedules run on your own gateway account - they are yours, and they keep running with your processor with or without us. On Pledgix One, we wind schedules down with you in an orderly way: donors are informed, and nothing keeps charging after you've gone.
Audit trail

Tzedakah money deserves a paper trail. It has one.

Append-only consent log

Every Pledgix One terms acceptance is written to an append-only legal log - guarded at the database level so it can be read and exported, never edited. The evidence outlives the campaign, and even the account.

Destructive actions are signed

Archiving, restoring, or deleting a campaign records who did it - account, email, IP, device - plus the before-and-after state and the stated reason. Sign-ins are logged the same way.

Every webhook, kept

Every inbound payment notification is recorded in an insert-only log - including malformed, duplicate, and failed-signature attempts - so money questions get answered from records, not memory.

Every email, accounted for

Transactional email passes through one logged choke point - when a donor says "I never got my receipt," we answer from the log, then resend.
Compliance

Certifications: what's real, what's in progress.

A rule we hold ourselves to on this page: we will never imply a certification we don't hold. Sophisticated donors and boards verify - and they should. Here is the honest state of each item:

  • PCI DSSCard data is captured and processed by PCI DSS-certified payment processors. Pledgix keeps card numbers off our servers entirely - minimizing PCI exposure by architecture, not by paperwork.
  • SOC 2 / ISO 27001Not yet certified - and we won't imply otherwise. Our controls (fail-closed access scoping, encrypted credentials, append-only audit trails) are built with these frameworks in mind, and certifications will be published on this page as they are completed.
  • PrivacyDonor data is collected for one purpose - your fundraising - and is never sold. Anonymous giving is enforced end to end, retention is deliberate rather than forever, and a data-processing agreement is available through our team for organizations that require one.
  • Donor tax receiptsLive today: every Pledgix One donation receives an automatic PDF receipt issued under our registered 501(c)(3); Pro campaigns issue automatic receipts under their own organization and branding.
  • Political campaign complianceDonor eligibility fields, certification capture, and FEC-ready exports are built into every Political campaign - live today.
The company behind the platform

Stability you can reason about.

Pledgix is a private company, so you won't find quarterly filings. Here is what matters more for a platform that handles tzedakah: donation money doesn't depend on our balance sheet. Charges run on regulated payment processors and settle to the receiving organization's side - if Pledgix disappeared tomorrow, your money wouldn't be inside it.

Pledgix is privately held and founder-led - established in 2026 and run from one office in Suffern, New York, by a focused team of about seven. There is no distant holding company and no anonymous operators: the people who build the platform and the people who answer your calls sit in the same room.

Who runs it, why they built it, and where it's going are not secrets either:

Our story & founderWho we are, where we came from, and the mission - names included.
Public roadmapWhat's planned, in progress, and shipped - with community voting.
The shipping recordA dated, public changelog of what we've actually delivered.