Security and online donations - some overlooked factors

Some standard guidelines for nonprofits accepting donations online are:

1. Use donation pages are 256-bit SSL encrypted
2. Protect your database by limiting access to it and hosting it with a reputable hosting provider
3. Hide Credit Card info.
4. Better yet, don't store credit card number.  Why do you need it?  Nothing good can come from a nonprofit saving a donor's credit card number.

These are fairly standard guidelines

But nonprofit managers overlook the donation trail.  Namely, the path that money from an online transaction takes at it makes its way to your organization's bank account?

Sometimes getting many different groups into the act is a good thing.  Take coffee for instance. The supply chain and complex.  But everyone involved from the farmer to the shippers, to the retailers themselves wring out the inefficiencies so I could buy some sweet fresh Columbian coffee for under $10 a pound.  It's magnificent.

But other times, like with your online donations, getting a lot of people into the act is a bad thing.  Several problems arise when an online donation makes too many stops on the way to your organization's beneficiaries. 

Let's follow the trail of a $100.00 donation made online through a typical nonprofit online donation system.

1. Day 1:  Donor retrieves credit card and submits an online donation to his friend who is running a marathon for charity
2. Day 1:  Data is transmitted to a payment processing firm that accepts the transaction
3. Day 3:  Payment processing firm deducts roughly $3.00 in fees
4. Day 3:  The remainder of the money is wired to the software company that hosts the web site where the donation was made
5. Day 5:  The software company deducts another $5 to $10 from the donation for their fees
6. Somewhere between Day 10-14:  Software company wires donations in batches to the nonprofits bank about
7. About 2 weeks later if your're lucky:  Most of the money is available to be used to run your organization's programs.

Steps 4 to 7 are unnecessary, costly, and inherently risky because:

The software company that is handling your money is typically a small, private company.  Lord only knows what their financial situation is.  What if they go out of business?  it shouldn't matter.  Your money should never be in the hands of the software company. 

The same rules apply for the public software companies too.  We know the one that was recently delisted  (starts with a "K "and rhymes with Schmintera).   We also know about the one that was supposed to go public but then pulled its offering (Starts with "C" and rhymes with Gronvio).  Delistings and IPO retractions don't happen at healthy companies.  The fact that they have your donors' money is a scary prospect for your organization. 

Plus, I'm sure these software companies, public or not, are not run like Swiss banks.  These are  software people (geeks like me) handling your money.  Why?  Would you have your accountants build your web site?  It's an unnecessary step.  

Your software vendor Absolutely does not need to handle your money

to populate your database with the information about the transaction. 

Let's not forget about the cash flow issue.  Why do you have to wait 10-15 business days to get your money?  This is a Pony Express timeline. What year is this?

So lets return to the plight of the poor $100 donation and its long journey to your organization's coffers.  This is the right way to do it.

1.  Day 1:  Donor retrieves credit card and submits an online donation to his friend who is running a marathon for charity

2.  Day 1:  Data is transmitted to a payment processing firm that accepts the transaction

3.  Day 3:  Payment processing firm deducts roughly $3.00 in fees

4.  Day 3:  The remainder of the money is wired to YOUR organization where you can use it for your programs.

If you're not doing it this way, what's your excuse?  Do your donor's know  bout the long journey that their money is about to embark on when they click submit?