Trust is your nonprofit’s most valuable asset — and in today’s digital environment, that trust extends beyond mission and impact. Donors increasingly want to know that the personal and financial information they share with you is handled with the same care you bring to your programs.
The good news: a few intentional steps can go a long way in communicating that security to your donors. Here’s what organizations should be doing right now.
The Landscape has Shifted — and Donors Know It
Cybersecurity incidents affecting nonprofits have risen steadily. High-profile breaches at large charitable organizations have made headlines, and donors — particularly major donors — are paying closer attention to where their data goes. According to a 2024 report from the Nonprofit Technology Enterprise Network (NTEN), nearly 30% of nonprofits reported experiencing a cybersecurity incident, yet fewer than half had a formal data security policy in place.
At the same time, AI-powered phishing attacks and payment fraud have grown more sophisticated, making it easier than ever for bad actors to target organizations with limited IT infrastructure. For nonprofits that process online donations, this isn’t a distant threat — it’s an operational reality.
PCI DSS 4.0: What You Need to Know
If your organization accepts online donations, PCI DSS (Payment Card Industry Data Security Standard) compliance is non-negotiable. The updated PCI DSS 4.0 standards went into full effect on March 31, 2025, introducing stronger requirements around authentication, web security, and monitoring.
Key updates that affect nonprofits with embedded donation forms include monitoring JavaScript files that load on your donation pages, implementing Content Security Policy (CSP) and Subresource Integrity (SRI), and enforcing multi-factor authentication (MFA) for any account with access to payment data. If you’re using a PCI DSS Level 1 compliant payment processor like RaiseDonors or FundraiseUp, much of this is handled on the backend. But your website still needs to meet the new front-end standards.
Not sure if you’re compliant? It’s worth a conversation with your payment processor and your web team.
3 Ways to Communicate Your Security to Donors
Compliance is the floor, not the ceiling. Once you’re secure, the next step is making sure donors know it. Here’s how:
1. On your donation page
A simple, visible security message near your donation form reduces hesitation at the moment of giving. Try something like: “Your payment is secure. Our donation system complies with PCI DSS standards and uses advanced encryption to protect your personal data.” A trust badge from your payment processor helps too.
2. On a dedicated FAQ or security page
This is the right place to name your PCI-compliant processor and explain exactly how donor data is handled — encrypted, never stored on your servers, never sold or shared. Donors who have concerns will look for this page. Make it easy to find.
3. In your gift receipt email
The post-gift confirmation is your final touchpoint in the giving experience. A brief footer line — “Your donation was securely processed in compliance with PCI DSS standards” — closes the loop and reinforces confidence.
Don’t Just be Secure. Be Seen as Secure.
In an environment where donors have more choices than ever, the organizations that communicate clearly about security will earn — and keep — more trust. This isn’t just an IT issue. It’s a donor relations issue.
If you’re unsure where your organization stands, or if you’d like help crafting the right messaging for your donation pages and receipts, we’d love to help.