Security at Civly

• Connections to Civly use HTTPS with TLS 1.2 or higher, and browsers are instructed to use HTTPS on every visit (HSTS).
• All data on Civly’s servers is stored on encrypted disks, including our databases, our data-processing systems and the machines that host them.
• Backups and off-site archive copies are encrypted.
• Stored credentials for connected accounting, banking and fundraising platforms are encrypted.

• Our production systems accept no inbound connections from the internet. Traffic reaches them through an encrypted tunnel behind Cloudflare, which provides DDoS protection and a managed web application firewall.
• The database cannot be reached from the internet and requires authentication.
• Administrative access to our servers requires a private network connection. Internal tools require a verified sign-in.

• Our team creates every client account. There is no public sign-up.
• Users sign in with a password or with Google, Microsoft or Apple. Passwords are stored as bcrypt hashes.
• Accounts that use a password can turn on two-factor sign-in with an authenticator app, with single-use backup codes.
• Sign-in, password reset and two-factor attempts are rate limited.

• Each client’s records are scoped to that client’s organization.
• Within an organization, permissions follow roles (administrator, user and viewer) and are enforced on our servers.
• Staff access to a client account is logged with who, when and from where.
• Sign-ins and API requests are logged with the user, time and network address.

• API keys are shown once when they are created and stored only as hashes.
• Each key belongs to one organization, works only for the products it was issued for, and can be revoked at any time.
• The API is rate limited per key and per network address.

• The production database is backed up continuously to encrypted off-site storage, with point-in-time recovery.
• Other systems are backed up nightly, and each backup is checked automatically.
• We have tested a full restore of the production database from backup.
• Automated checks from outside our systems confirm every five minutes that Civly is up, and alert our team when it is down.

Civly’s research, writing and analysis features use AI models from several providers, including Anthropic, OpenAI and Google.

Clients can ask us to send their work only to providers in the United States, and only to providers that do not retain or train on submitted data.

Card and bank payments are processed by Stripe. Card numbers go directly to Stripe, and Civly keeps only the card brand, the last four digits and the expiration date.

Civly’s servers and backups are in the United States. Some AI providers may process information in other countries, as described in our Privacy Policy.

Cloudflare handles network security and content delivery, Backblaze holds encrypted backups, DigitalOcean stores files, SendGrid sends email, Twilio sends text messages and verifies phone numbers, and Stripe processes payments. We share the full list during client security reviews.

GitHub secret scanning and push protection are turned on for our product code, so a code change that contains a key or password is blocked before it is saved.

If we learn of a security incident that affects a client’s data, we will notify that client promptly and as required by law.