Security & Trust at NewOrg

The NewOrg Management System is a hosted, web-based solution for nonprofit data management. It runs in a secure, redundant private cloud environment that is expected to maintain 99.9% availability.

Secure data centers

Client data is hosted in secure facilities in either Dallas or Toronto.

Built-in redundancy

The private cloud uses redundant power, networks, and internet connections.

Separate client databases

Each client database is separate and has its own admin user security.

Separated layers

Database and web layers are kept separate, behind overlapping layers of security.

Encryption at rest

Data stored in NewOrg systems is encrypted at rest, including backups.

Encryption in transit

Client access to the NewOrg application is protected with TLS encryption. Data in transit, including data sent to offsite backup locations, is encrypted. When staff share a document with a stakeholder, only a link is sent by email or SMS. No files or client information are included in the message.

Clients control what their users can see and do through flexible permission levels, set by the client’s System Administrator or NewOrg Support.

Multi-factor authentication

Users sign in with a username and password, plus a confirmation by SMS or email.

Restricted administrative access

Server access is limited to NewOrg’s software engineering group through auditable accounts. Administrative access is restricted to specific IP addresses through a VPN.

Login monitoring and lockouts

Suspicious login attempts are monitored, and IP addresses are automatically locked out after multiple failed attempts.

Optional location restrictions

Partners can restrict access to their public-facing portal and administrative login sites to specific countries or continents.

Quarterly account reviews

NewOrg checks for dormant accounts and for changes to user accounts or permissions every quarter.

The platform uses several overlapping layers of security. A managed, enterprise-class hardware firewall monitors the network for suspicious activity, and firewalls block all ports except HTTP and HTTPS. Individual servers have secure operating system configurations, software firewalls, and antivirus protection.

Within the application, all NewOrg forms use SQL injection protection and public-facing forms use CAPTCHA. All activity in the system is stored in an audit table, so administrators can review record views and field-level updates, inserts, and deletes by user, date and time, field, and activity type.

Regular security and data integrity audits

Regular backups

All NewOrg databases and systems are backed up nightly, with hourly system snapshots.

Stored in more than one place

Backups are stored on a local storage array and at secondary disaster recovery sites.

Encrypted

Backups are encrypted in transit and at rest.

30 days of history

NewOrg maintains 30 days of daily backups to support data integrity and recovery.

Failover facilities

Failover facilities are located in Chicago and Vancouver.

NewOrg updates are tested thoroughly before deployment. Major updates and feature changes first go to voluntary beta test customers for a minimum of two months before wider release.

Client-specific portal pages are tested before deployment, and core application endpoints and pages go through penetration testing every quarter.

For active partners, NewOrg maintains a permanent history of all data, along with all access to and changes to that data.

When a partner has specific retention and disposal requirements, NewOrg can provide an annual purge of data older than a specified age. Purged data can be deleted completely or archived in an encrypted, offline state. Purged data cycles out of NewOrg’s primary backups within 30 days.

NewOrg investigates and contains security incidents promptly to protect customer data. Affected customers are notified in writing without undue delay, and no later than 72 hours after confirmation of an incident affecting their data. Notifications include known details of the incident, affected data, containment measures, and a NewOrg point of contact.

Following a security breach, NewOrg conducts a root-cause review and strengthens security measures to help prevent future incidents. Notifications to affected individuals and regulatory authorities are handled in accordance with applicable legal requirements.

The NewOrg platform has been engineered with industry security best practices in mind, as well as with HIPAA, PIPEDA, and GDPR requirements. Clients remain responsible for how they configure and use the platform within their own compliance obligations.