Trust Center
How khelp protects your organization's and your donors' data.
Current technical practices — reviewed continuously as the product evolves.
khelp is a multi-tenant management platform for NGOs and nonprofit organizations. Security and privacy are handled by design, not as an optional feature. Here, in plain language, is what we do to protect your data.
Isolation between organizations
Each organization is an isolated tenant. Every database query is filtered by organization, and access to each record is validated by the requester's session — never by email or a guessable parameter. One organization can never see another's data.
Secret encryption
Integration credentials and authentication secrets are stored encrypted, with versioned keys that can be rotated without downtime. Passwords and tokens never travel to or appear in the frontend; when a secret only needs to be compared, we store just its hash.
Authentication and access
Managed login with optional two-factor authentication (2FA/TOTP), sessions that can be revoked at any time, and trusted-device recognition. Each role — super admin, organization, staff, donor — only sees what pertains to it, always validated on the server.
Immutable audit trail
Relevant administrative and financial actions are recorded in an append-only trail: who did it, what, when, from where, and the before/after. Records cannot be altered or deleted — a correction is always a new record.
Payment rigor
Money movements follow payment-provider standards: what the organization pays and the provider's cost are separate entities. Every change to financial settings requires password re-confirmation and is audited, and each charge is validated before the gateway is called.
Privacy and data protection
We handle personal data in line with data-protection law. Data subjects can unsubscribe from communications at any time, and their language and preferences follow the person.
Infrastructure and availability
The platform runs on managed infrastructure over a managed PostgreSQL database, with automatic backups and continuous updates — with no planned downtime windows for day-to-day use.
Report a vulnerability
Found something that looks like a security flaw? Contact platform support. We take security reports seriously and respond as soon as possible.
This document describes current technical practices and evolves with the product. It does not replace the applicable contractual terms.