PCI compliance for organizations using Fundraise Up

Using Fundraise Up simplifies PCI compliance by offloading much of the technical responsibility to us. For example, Fundraise Up tokenizes and encrypts all payment data, ensuring sensitive cardholder details are never stored on your organization’s systems. This greatly minimizes your exposure to risk.

However, your organization still has obligations. Most organizations will need to complete an annual Self-Assessment Questionnaire (SAQ) to affirm compliance. For organizations using Fundraise Up, SAQ A is the appropriate choice, as it applies to organizations outsourcing payment processing without storing cardholder data.

Here’s what you need to do:

1. Obtain the SAQ.
   • Option 1: Receive the SAQ A from your payment processor (Stripe or PayPal).
   • Option 2: Request a pre-populated SAQ A from Fundraise Up, which requires minimal additional information to complete.
2. Complete and submit the SAQ.

   Submit the SAQ A directly to your payment processor through their designated portal or instructions. Be mindful of submission deadlines, which are often outlined in processor communications.

3. Seek clarification if needed.

   If you’re unsure about the SAQ or deadlines, reach out to your processor’s support team for guidance.

If you receive a letter from Stripe or PayPal about PCI compliance, it is likely a reminder of your organization’s responsibility to:

1. Ensure that you are using their services in a PCI-compliant manner.
2. Complete and submit your annual SAQ.

These letters are standard practice and not an indication of non-compliance. They’re simply part of maintaining proper documentation and accountability.

Here’s a clear outline of what organizations using Fundraise Up should do:

1. Understand your scope of compliance:
   • Fundraise Up handles sensitive cardholder data on your behalf, which reduces your organization’s scope for PCI compliance. However, you’re still responsible for ensuring your staff follows best practices.
2. Complete the appropriate SAQ annually:
   • Most nonprofits will complete SAQ A, which is the simplest version, since Fundraise Up manages all payment processing and data storage.
   • Follow the instructions provided by your payment processor (Stripe or PayPal) for completing the SAQ.
3. Train your staff:

   Ensure all staff members who handle payment data understand basic security practices, such as:

   • Avoiding phishing scams.
   • Using secure passwords.
   • Not storing sensitive cardholder data on internal systems.
4. Maintain secure systems:
   • Regularly update your computers and software to protect against vulnerabilities.
   • Use secure networks, particularly when accessing Fundraise Up’s platform or other payment systems.
5. Monitor your website for tampering:
   • Implement tools that detect unauthorized changes to your website, aligning with PCI DSS Requirement 11.6.1 (see details below).
6. Keep documentation up-to-date:
   • Save copies of your completed SAQ and any related correspondence from payment processors for your records.

PCI DSS version 4.0.1 is the latest update to the Standard and will go into effect on March 31, 2025.

Key updates include:

• Requirement 6.4.3: Inventory and secure scripts

  Organizations must inventory, authorize, and secure all JavaScript files interacting with payment forms to ensure only authorized scripts are used.

• Requirement 11.6.1: Anti-tamper detection

  Automated tools must monitor web pages for unauthorized modifications, providing real-time alerts to prevent potential breaches.

For nonprofits, this means staying updated on these requirements is crucial for continued compliance.

Fundraise Up is committed to supporting organizations as they navigate these new standards. Here’s how we can help:

• Educational resources: We will provide educational webinars and detailed resource posts to help organizations understand and implement these new requirements effectively. These sessions will cover practical steps for script management and anti-tamper monitoring implementation.
• Vendor recommendations: Recognizing the budget constraints many nonprofits face, Fundraise Up will recommend pre-vetted security vendors who offer solutions specifically tailored to nonprofit organizations’ needs and financial capabilities. These partnerships will help ensure compliance without overwhelming organizational resources.

For more detailed guidance, consult the following resources:

• Official PCI DSS Website
• Stripe’s PCI Compliance Guide
• Fundraise Up’s Blog on 2025 PCI Requirements