Security

Effective Date: August 31, 2026

This page describes how MonthFund protects the Service today. It is not a certification, audit report, or guarantee. For legal terms see our Terms of Service and Privacy Policy.

Payments

Card numbers are collected and stored by Stripe. MonthFund does not store full card numbers. When an organization or personal fundraiser has completed Stripe Connect, charges go to that connected account. Eligible organizations may appoint MonthFund as a limited payment agent while Connect is unfinished. Those gifts stay held until Connect and payouts are ready, as described in the Terms.

Transport and access

Traffic to the Service uses TLS. Application data lives in a hosted Postgres database with row-level access rules. Dashboard and admin routes require an authenticated session. Super-admin tools are limited to MonthFund staff accounts.

Vendors

Hosting, email, SMS, analytics, and payments run on third-party processors. The current list is on our Subprocessors page.

Report a problem

Email security issues to hello@monthfund.com. Include steps to reproduce and the affected URL. Do not send donor card data.