Inside the GiveCampus Trust Center

Last year alone, more than 1,500 schools raised $10 billion using GiveCampus. On the biggest giving day of the year, thousands of those gifts were transacted within minutes of each other. Behind each one sits a donor’s name, payment information, and a relationship a school has often spent years building. That volume, arriving all at once, tests what a fundraising platform can actually handle, and it tests it in public, on a day when the margin of error needs to be zero.

Meeting that standard starts with security that runs on its own schedule, independent of any single giving day. Certifications require renewal. Monitoring runs continuously. Practices get retested against new threats. That ongoing work holds up on an ordinary Tuesday and on the highest-volume giving day of the year—and it’s now visible in one place: the GiveCampus Trust Center..

What security looks like day to day

GiveCampus is SOC 2 Type 2 certified. Our most recent HECVAT (Higher Education Cloud Vendor Assessment Template) is available as well as PCI attenuations covering its payment environment, alongside GDPR and CCPA compliance. It runs on Amazon Web Services with High Availability and Disaster Recovery.

School admins and their teams sign in through single sign-on and multi-factor authentication. Single sign-on connects to the identity systems a school’s advancement services or IT department already runs, so adding the platform does not mean managing another separate set of passwords. Data gets encrypted with Transport Layer Security while it moves, and encrypted again while it sits in storage. GiveCampers monitor systems, apply software updates, and complete security training on an ongoing basis, and an independent audit firm tests those controls each SOC 2 cycle.

Stripe and PayPal handle payment processing under their own PCI DSS attestations, so sensitive card data goes directly to them and never touches GiveCampus systems. GiveCampus stores the donor information needed to run the platform—names, gift amounts, contact details—and does not share it outside the relationship between a school and its donors.

Reliability runs on the same infrastructure. A giving day concentrates a year of transaction volume into a few hours, and the platform is built to hold that load without slowing down or dropping a gift. Disaster recovery planning covers the scenario schools worry about most: staying online during the exact hours when the most donors are giving.

The full breakdown—including answers to common security questions—lives on our security and reliability page.

Accessibility gets the same standard

GiveCampus meets section 508 accessibility standards and ensures we meet key accessibility standards by testing its accessible constituent-facing experience—campaign, giving, event, and event registration pages—against WCAG 2.2 Level A and AA. That testing combines automated tools like axe DevTools and color-contrast analyzers with manual testing using NVDA and VoiceOver on Windows and macOS. Each success criterion gets reported as it actually performs, including partial support, and remediation continues from there as regulatory deadlines, including the DOJ’s Title II timeline, move forward. VPAT 2.5 reports covering constituent experiences for GC Events and GC Online Giving will join the Trust Center as that work progresses. Partners with questions, accommodation requests, or reports of a barrier can reach the team at support@givecampus.com.

One place to see all of it

When a school’s IT team conducts a vendor security review, they usually have to email the vendor, wait for a response, and repeat that cycle for every new report or policy update. The GiveCampus Trust Center shortens that cycle: it puts the current list of certifications and subprocessors in front of a reviewer right away, with no request required. The full reports behind those certifications—the SOC 2 Type 2 report, the HECVAT assessment, PCI documentation, and a cloud security assessment—require one request tied to an NDA. 

Because the Trust Center connects to the platform’s live monitoring, control statuses update automatically.

Data stewardship is a stated principle

Schools bring donor relationships built over years, sometimes decades, onto the GiveCampus platform. Data stewardship sits among the technology principles we state publicly, alongside a commitment to evaluate new technology with patience before adopting it. Everything described above—the certifications, the encryption, the uptime work, the accessibility testing—is what that principle requires in practice, and it’s what the GiveCampus platform is built to deliver.

Reviewers, advancement services and IT teams, and curious Partners can explore those certifications, policies, and reports directly at the GiveCampus Trust Center.