Are payments secure?
Yes. Every payment made through Donoor is processed by Stripe or PayPal, two major online payment providers used by millions of businesses around the world, and no bank card data ever passes through Donoor's servers. The money goes directly to your association's Stripe or PayPal account, never to a Donoor account.
This page explains what protects a card payment, what changes for a donation collected in person with Tap to Pay, and how to choose who in your team can view or manage these payments.
Your card details never pass through Donoor
On the donation page, the box where the donor enters their card number is provided directly by Stripe, or by PayPal if that is the provider your association has chosen. Donoor never reads this card number, nor the security code on the back of the card: our servers only receive a payment identifier, once Stripe or PayPal has validated it.
This also works the other way round: even in your dashboard, the details of a card payment do not show the last digits of the card, as Donoor does not keep them. For that level of detail, your association finds the information directly in its Stripe or PayPal account.
This separation allows Donoor to comply with the PCI-DSS standard, which governs the security of card payments worldwide, without ever handling your bank details. Stripe is certified at its highest level (Level 1), verified every year by an independent auditor; PayPal also complies with this standard.
Enhanced verification when the bank requires it
For some payments, the donor's bank asks for an additional check before authorising the transaction: a code received by text message, or a confirmation in the bank's app. This is known as 3D Secure. Stripe and PayPal trigger it automatically when the bank requires it, without any action from your association.
Each provider's fraud detection
In addition to this verification, Stripe and PayPal analyse each payment with their own fraud detection system (Radar, on the Stripe side) before letting it through. This check is automatic: neither the donor nor your association has to deal with it, unless the payment is declined.
And for a donation collected in person with Tap to Pay?
When you collect a donation with Tap to Pay, your association's phone becomes a contactless payment terminal. The card data is encrypted and is never stored on the phone: neither the full number, the security code nor a PIN is visible to the app. Depending on the amount or the donor's card, a PIN may be requested, entered on a secure keypad. Tap to Pay works on iPhone and on compatible Android phones: all the details are in What is Tap to Pay for associations?
The money never passes through a Donoor account
Donoor is never a financial intermediary. Every donation goes directly to your association's Stripe or PayPal account, never to a Donoor account. There is no step where the money would pass through Donoor and could get stuck there. To find out when this money reaches the association's bank account, read When do I receive donations?
Who in your team can view or manage payments?
Each member of your team is given a role that determines what they can see and do: some have access to the list of donations and donors, others do not, and connecting or disconnecting a Stripe or PayPal account is, by default, reserved for the owner and administrators. You set these rights in Settings › Team.
On this same page, the History button shows, for one member or for the whole team, the recorded creations, edits, deletions and logins: a way to see who did what, and when. To invite your team and set its rights, read How do I invite my team members and manage their rights?
| Payment step | Who handles it | What protects you |
|---|---|---|
| Entering the card | Stripe or PayPal | The card number never passes through Donoor's servers |
| Bank verification | The donor's bank, via Stripe or PayPal | 3D Secure triggered automatically when the bank requires it |
| Fraud detection | Stripe or PayPal | Each payment is analysed before being accepted |
| Arrival of the money | Stripe or PayPal | Paid directly into the association's account, never into a Donoor account |
| Access within your team | Your association | Each member's rights are set in Settings › Team |
Good to know: Donoor never has access to your full card number or its security code, not even to display it in the dashboard. For the exact details of a card payment, check your Stripe or PayPal account directly.
Tip: the fees applied to each payment depend on Stripe or PayPal, not on Donoor. The details are explained in What are the transaction fees?
Important: if a donor disputes a payment with their bank, or if you need to refund a donation, Stripe or PayPal handle it directly, from the balance of your account. See How do I refund a payment and what should I do in case of a dispute?
Key takeaways
- Payments go through Stripe or PayPal: Donoor never sees or stores your card details.
- 3D Secure and each provider's fraud detection apply automatically to every payment.
- The money arrives directly in the association's Stripe or PayPal account: Donoor never holds your funds.
- Tap to Pay encrypts card data and never stores it on the phone.
- You choose, in Settings › Team, who can view or manage payments, and you can review your team's action history.