Trust & Security at Dymatrix

Dymatrix Solutions offers DonorFile

Donor records are personal and often sensitive. Here is how we protect them, what we have in place today, and what we are still building.

 

Last updated: November 2026

 

Where we are

Donorfile is an early-stage product of Dymatrix. We do not yet hold a SOC 2 report. We are building our security program to SOC 2 standards from the start, and we are happy to share our policies and complete your security questionnaire.

 

Security practices

Practice What we do Status
Encryption in transit All traffic to Donorfile uses TLS 1.2 or higher. In place
Encryption at rest Customer data is encrypted at rest by our cloud provider Amazon Web Services. In place
Access control Multi-factor authentication is required for our team on all systems that touch customer data. Production access is limited to those who need it. In place
Customer sign-in Complex passwords are required.  Password policy and  MFA options for Donorfile users in the works. In progress
Backups Automated daily backups, encrypted and retained for 30 days. In place
Secure development Changes to production are reviewed and tested. Systems are kept upto date with required software and security updates. In place
Employee devices Company laptops use full-disk encryption and screen locks. We use a password manager. In place
Incident response A written plan for detecting, containing and reporting incidents, including notifying affected customers. In progress
Penetration test Independent third-party test of the application. Planned Q3 2027
SOC 2 Type I first, then Type II. Planned Q4 2027

 

How we handle donor data

 

      • You own your data. We use it only to provide Donorfile to you, and we never sell it.

      • Payment card details are handled by Stripe via ChargeBee during the creatio of your subscription. Should you choose to integrate donations to your organization with Donorfile, Stripe or your processor will manage all payment detail. Donorfile does not store full card numbers.

      • Customer data is hosted in the United States.

      • You can request an export your data at any time. When you leave, we delete your data within 30 days of your request, apart from what the law requires us to keep.

      • Our staff do not access customer data except to provide support you request or to resolve a security or reliability issue.

     

    Vendors that process data for us

     

    Vendor Purpose
    Amazon Web Services Hosting and storage
    ChargeBee and Stripe Payment processing
    SMTP2Go Transactional email
    Cheklyhq Application monitoring
    iDrive Secure Data backup

     

    We choose vendors that maintain their own security certifications, such as SOC 2 or ISO 27001, and we review the list as we grow.

     

    Privacy and compliance

    Our privacy practices are described in our privacy policy. If you need a data processing agreement, ask us at the address below.

     

    Report a vulnerability

    If you believe you have found a security issue, email security@dymatrix.com  Include enough detail for us to reproduce it. We will acknowledge your report within [2] business days and keep you updated until it is resolved. Please give us a reasonable chance to fix the issue before sharing it publicly, and do not access data that is not yours.

     

    Request our security documents

     

    We can provide our security policies, a completed security questionnaire, and a summary of our architecture. Email security@dymatrix.com and tell us what your team needs.