Lesson 2 of 5
Security
Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.
How data is protected
Many tools use encryption. The topic page shows what each provider says. It scrambles your data while it travels and while it is stored, so a thief who grabs it sees nonsense.
Encryption is a good lock on the door. It does not decide who gets a key.
What audits do and do not prove
Independent audits, such as SOC 2, check that a company follows written security practices. That is useful evidence.
An audit does not promise nothing will ever go wrong. It also does not say how a company handles your data for training. That is a separate question, covered in the privacy lesson.
Who inside your organization should have access
Give accounts to the people who need them, and take them away when people leave.
Business plans often add single sign-on and admin controls. These let one person manage who is in and who is out.
Use a work account, not a personal one, for work tasks. Then your organization can close it when needed.
The human risks
Most problems start with people, not code. Watch for phishing emails that pretend to be a login page.
Do not share one password across a team. Do not paste the wrong thing, like a donor list, into a chat box by mistake.
Turn on two-step sign-in. It adds a second check, like a code on your phone.