Security
How we protect this website and your information, how to spot a scam using our name, and how to report a vulnerability.
Our approach
We hold information about donors, volunteers and people in vulnerable situations. Losing control of that information would cause real harm, so we treat security as part of safeguarding rather than as an IT afterthought.
This page sets out how we protect the website and your data, how to recognise a scam using our name, and how to report a security problem to us.
How this website is protected
- Encryption in transit. The site is served over HTTPS with a valid TLS certificate. Requests to the insecure version are redirected, and HSTS tells browsers to use HTTPS from the outset.
- Security headers. We set a Content Security Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and a restrictive Permissions-Policy, so the site cannot be framed by another, cannot load unexpected scripts, and does not leak referrer data.
- A small attack surface. The site is static. There is no content management system to compromise, no database attached to the public pages, and no user accounts or passwords held here.
- No card data. Payments are handled entirely by a regulated payment provider. Card numbers are never sent to, processed by, or stored on our systems.
Donation security
Online donations are made through GoFundMe, which processes all card payments on its own secure platform. You will leave our site and see GoFundMe’s page, and the padlock in your browser, before entering card details.
We keep a record of the amount, date and your contact details so we can thank you, claim Gift Aid and account for the gift. We do not keep your card number, expiry date or security code, and we could not retrieve them if we wanted to.
How we protect information internally
- Access to donor and volunteer records is limited to the people whose role requires it.
- Accounts use multi-factor authentication wherever the service supports it.
- Devices used for charity work are kept up to date and encrypted.
- Personal data is not sent over personal messaging apps or held on unencrypted memory sticks.
- Volunteers and trustees are briefed on data protection as part of induction.
If a breach occurs that is likely to risk people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell those affected without undue delay.
Scams using our name
Charity names get borrowed by fraudsters. Please read this bit even if you skip the rest.
We will never phone, email or text you to ask for your card number, PIN, online banking password or a one-time passcode. We will never ask you to move money to a “safe account”, and we will never send you an urgent message saying our bank details have changed.
Signs that a message is not from us:
- It creates urgency, or pressures you to act before you can check.
- The sending address is not on the rosedalefoundation.co.uk domain.
- It asks for payment by gift card, cryptocurrency or voucher.
- It sends you to a donation page other than our official GoFundMe page.
If you are unsure whether something came from us, do not reply to it. Contact us using the details on this website instead. If you think you have been targeted, report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk, and in Scotland to Police Scotland on 101.
Reporting a security problem
If you believe you have found a vulnerability in this website, please tell us. We will not take legal action against anyone who reports an issue in good faith and in line with this section.
Email office@rosedalefoundation.co.uk with the subject line “Security” and enough detail for us to reproduce the problem. We will acknowledge your report within five working days and keep you updated until it is resolved.
Please do
- Give us reasonable time to fix the issue before disclosing it publicly.
- Limit your testing to what is needed to demonstrate the problem.
- Stop immediately and tell us if you encounter personal data.
Please do not
- Access, modify or delete data belonging to anyone else.
- Run denial-of-service tests, automated scanning that degrades the site, or social engineering against our staff and volunteers.
- Demand payment in exchange for details of a vulnerability.
We are a small start-up charity and we do not run a paid bug bounty, but we will thank you properly and credit you if you would like us to.
Keeping yourself safe
- Check the address bar says rosedalefoundation.co.uk before entering anything.
- Use a unique password for your email account, and turn on two-factor authentication.
- Review your bank statement after donating, and tell us straight away if something looks wrong.