Security

Lighthouse Results processes fundraising response data on behalf of agencies and the nonprofits they work for. This page describes how that is protected.

Hosting

The application runs on Microsoft Azure. Data is encrypted in transit and at rest, and the database supports point-in-time restore.

Tenancy and access

Client scoping is enforced on the record itself rather than by hiding navigation. There is no view that can be linked into, guessed at or shared that crosses a client boundary. Access is governed by six roles, described in detail on the product page.

This website

This marketing site is static. It sets no cookies, loads no third-party scripts, and serves its own fonts. It is delivered over HTTPS with HSTS, a restrictive Content Security Policy, and framing disabled.

Reporting a vulnerability

If you believe you have found a security issue, write to nick@lighthouseresults.com with enough detail to reproduce it. We will confirm receipt and keep you updated while we investigate.

[DISCLOSURE POLICY — acknowledgement and remediation timelines, and safe-harbour language for good-faith research. Do not publish times that cannot be met.]

Certifications and audits

[CERTIFICATIONS — SOC 2, penetration testing cadence, sub-processor list. Leave this section out entirely rather than implying something that is not in place.]