Security and privacy

You are trusting us with your neighbors' and members' details and your group's books. Here is exactly how they are protected, without the jargon where we can avoid it.

Your money

We never hold it. Online payments go from the payer to your group's own Stripe account and on to your bank. We cannot move, hold or refund your money.
We never see card or bank numbers. Those are entered on Stripe's pages and stay with Stripe.
We never ask for your bank login. There are no bank feeds.

Your records

Each group's data is walled off in the database itself. Every query runs inside one group's boundary, enforced by the database (row-level security), not only by our code. An automated test tries to read across groups on every page before each release.
The ledger cannot be rewritten. Charges and payments are never edited or deleted, by you or by us. Corrections are new entries, so the history always adds up.
Everything is logged. The audit log shows who changed what and when. It cannot be edited either.
Encrypted in transit and at rest. All traffic uses HTTPS. Backups are encrypted before they leave the server, with a key that is kept offline.
Backups every night, kept for 30 days and then monthly for a year, and restored in a test regularly so we know they work.

Signing in

Two-factor authentication is required for anyone who can change money or roster data (admins and treasurers), and for every export.
Sign-in by email link, so members have no password to reuse or forget. Officers can add a password of at least 12 characters; it is stored only as a slow, salted hash.
Roles: admin, treasurer, board (can look, cannot change) and member (sees only their own unit or membership).
You can see your active sessions and sign out everywhere with one click.

Our staff

We cannot see inside your group by default. Our own console shows service health, who has a login, each group's plan, and totals such as how many units a group has and how much was paid online. It does not show your ledger, your roster or your documents.
You decide if support can look. An admin can switch on support access for 24 hours, 3 days or 7 days, and switch it off at any moment.
Support access is read-only, enforced by the database, and every page a support person opens is written to your audit log.

Your data stays yours

Export everything as spreadsheets plus your files, at any time, including for 90 days after you cancel.
Delete a person and their contact details are erased after 30 days (you can undo it until then). Their payments stay with the unit, because your books need them.
Delete your group and everything, files included, is erased after a 30-day undo window.
We do not sell data, show ads, or use your members' details for anything except running your group's account. See the privacy policy and the companies we rely on (subprocessors).

Where it runs

The service runs in the United States: the application and database on DigitalOcean, files and backups on Cloudflare R2, email through Resend, payments through Stripe. Traffic passes through Cloudflare, which also filters attacks.

Reporting a problem

If you think you have found a security problem, write to support@duesdesk.app with "Security" in the subject. We answer every report.