Security

Security is fundamental to everything we do at RallyDues. We understand that you're trusting us with sensitive financial data, and we take that responsibility seriously.

Our security program is designed to protect your organization's data, your members' personal information, and all payment transactions processed through our platform.

In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3, the latest and most secure transport layer security protocol.

At Rest: All stored data is encrypted using AES-256 encryption, the same standard used by banks and government agencies.

Backup Security: All backups are encrypted and stored in geographically distributed, secure data centers.

We partner with Stripe for all payment processing. Stripe is a PCI Service Provider Level 1 certified company—the most stringent level of certification available in the payments industry.

Key protections include:

• Full card numbers never touch our servers

• Tokenization of all payment methods

• 3D Secure authentication support

• Real-time fraud detection and prevention

• Automated suspicious activity monitoring

Our infrastructure is hosted on industry-leading cloud platforms with enterprise-grade security:

• Data Centers: SOC 2 Type II certified facilities

• Network Security: Multi-layer firewall protection and DDoS mitigation

• Monitoring: 24/7 automated monitoring and alerting

• Redundancy: Multi-region deployment for high availability

• Updates: Regular security patches and system updates

We implement strict access controls to protect your data:

• Role-Based Access: Granular permissions for administrators and delegates

• Authentication: Secure password requirements and session management

• Employee Access: Limited to authorized personnel with business need

• Audit Logging: Comprehensive logs of all system access and changes

• Regular Reviews: Periodic access audits and privilege reviews

We maintain compliance with relevant security and privacy standards:

• SOC 2 Type II: Annual audits by independent third parties

• GDPR: Compliance with European data protection regulations

• CCPA: California Consumer Privacy Act compliance

• PCI DSS: Payment Card Industry Data Security Standard (via Stripe)

We regularly engage external security firms to perform penetration testing and vulnerability assessments.

We maintain a comprehensive incident response plan:

• Detection: Automated monitoring for security anomalies

• Response Team: Dedicated security team on-call 24/7

• Communication: Prompt notification of affected parties

• Remediation: Swift action to contain and resolve incidents

• Post-Incident: Thorough analysis and preventive measures

In the event of a security incident affecting your data, we will notify you promptly in accordance with applicable laws.

Help us keep your account secure by following these best practices:

• Strong Passwords: Use unique, complex passwords for your RallyDues account

• Secure Access: Avoid accessing your account on public or shared computers

• Verify Emails: Be cautious of phishing attempts; we'll never ask for your password via email

• Update Information: Keep your contact information current for security notifications

• Review Access: Regularly review who has access to your organization's account

• Report Concerns: Contact us immediately if you notice any suspicious activity

If you discover a security vulnerability or have security concerns, please contact us immediately:

Security Team: security@rallydues.com

We appreciate responsible disclosure of security vulnerabilities and will work with you to address any issues promptly.

For general security questions, you can also reach our support team at support@rallydues.com.