Security and privacy

Payment card data #

Card entry is handled by Stripe’s payment interface. GiveBlocks does not store complete card numbers or CVC values.

Site credentials #

The GiveBlocks site API key and webhook secret are encrypted before storage in WordPress and are not displayed in the current Settings UI.

WordPress security still matters. An attacker with control of the site, database plus WordPress salts, or server code may be able to access sensitive operations.

Recommended site controls #

• Use HTTPS everywhere.
• Keep WordPress, GiveBlocks, themes, and other plugins updated.
• Use unique administrator accounts and strong passwords.
• Require multifactor authentication for administrators.
• Limit administrator access.
• Remove unused plugins and themes.
• Use a reputable host and firewall.
• Back up the database and files.
• Protect wp-config.php and WordPress salts.
• Do not log secrets or full webhook payloads unnecessarily.
• Use separate test and production credentials.
• Review administrator and volunteer accounts regularly.

Donor and attendee data #

The WordPress database can store names, email addresses, comments, transaction history, attendee details, volunteer preferences, add-on selections, ticket codes, and Stripe identifiers.

The site owner is responsible for:

• Publishing an appropriate privacy policy.
• Establishing retention and deletion procedures.
• Responding to applicable data-access requests.
• Limiting access to donor and attendee records.
• Ensuring imported data was collected and used lawfully.