Security and Student Data Controls, ScanRaise

Payments

Donors pay on Stripe's hosted checkout. ScanRaise does not store full card numbers or bank details.
Use your organization's Stripe account, let ScanRaise collect, or link QR cards to existing donation pages; see how the collection choices work.
Stripe is certified as a PCI DSS Level 1 service provider. That certification covers Stripe, not ScanRaise.
We confirm that every payment update really came from Stripe before we record it.

Every page and connection uses HTTPS.
The connection between our servers and our database is encrypted with TLS.
Location, step, and Fitbit data from tracking is encrypted before it is stored, and so are Fitbit sign-in tokens.
Backups are encrypted in transit and at rest.

A parent must give consent by email before a child under 13 can use the tracker or scavenger hunt check-ins.
Children known to be under 13 stay off public pages and leaderboards, and donor receipts name the campaign instead of the child.
Tracking data is deleted from our live database 90 days after the campaign ends.
For children, use a first name and last initial. Clever imports and our roster template already format names that way, and you can review every name before it goes public.
We do not sell or share student data with advertisers, marketers, or data brokers.
ScanRaise is listed in the SDPC resource registry. A listing is not a certification or a signed data privacy agreement. Each school or district decides whether its use meets FERPA and its own policies.
Schools and districts can ask for their data or ask us to delete it. The Privacy Policy explains how.

Organization owners and admins manage their own organization's campaigns, donations, and participants. Members with view-only access can look but not change anything. Only owners can issue refunds.
Public campaign pages show participant names and totals, except for children known to be under 13.
A small number of ScanRaise staff can open any organization's data to give support.

No passwords. You sign in with a one-time email link or a passkey, such as Face ID, Touch ID, or Windows Hello.
Sessions end after 30 minutes without activity, or 15 minutes for ScanRaise staff.
Sign-in requests are rate limited.

Automated off-site backups are stored with a different provider from our database.
Each backup is checked when it runs, and a failed run alerts us by email.
Old backups are deleted on a schedule. Changes made after the latest backup could be lost in a disaster.

A strict Content Security Policy and other security headers on every page.
Our pages cannot be embedded in other sites, except the donation widget, which secure HTTPS sites can embed.

StanHattie LLC, which operates ScanRaise, carries General Liability and Errors & Omissions coverage through Next Insurance. Verify coverage.

Email support@scanraise.com with [Security] in the subject line. We read every report. We do not run a paid bug bounty.