Bonterra Trust Center | Powered by SafeBase

Bonterra products streamline social good work across the full mission-driven sector - serving nonprofits, foundations, government agencies, and corporate giving programs with purpose-built software for grants management, fundraising, case management, civic engagement, and corporate social responsibility. Bonterra's integrated portfolio helps social good leaders reduce administrative burden, measure impact, and scale their mission at every stage of the funding and service delivery cycle.

Novartis
Cisco
Bank of America
Walmart
Verizon
Pfizer
CASA of Los Angeles
Phoenix Family
First 5 Riverside
Brooklyn Community Services
RISE for Youth
Feeding America
Special Olympics
National Audubon Society
NAACP

BONTERRA COMPLIANCEISO/IEC 27001:2022

3

BONTERRA COMPLIANCESOC 1

1

BONTERRA COMPLIANCESOC 2

3

BONTERRA COMPLIANCEISO/IEC 27001

1

BONTERRA COMPLIANCEISO/IEC 42001:2023

6

BONTERRA COMPLIANCEPCI DSS v4.0.1

4

BONTERRA COMPLIANCETX-RAMP Level 2

1

REPORTSPentest Report

REPORTSBonterra Dispursement Services System SOC 1

3

Data Access Level

3

Impact Level

3

Recovery Time Objective

3

Multi-Factor Authentication

7

Product Architecture

7

Role-Based Access Control

7

Bonterra Dispursement Services System SOC 1

3

Network Diagram

4

PCI DSS

3

Other Self-Assessments

1

Data Backups

8

Encryption-at-rest

8

Encryption-in-transit

8

Application Penetration Testing

6

Code Analysis

6

Credential Management

6

AI Monitoring

4

AI Risk Management

4

AI Governance

4

Anti-Bribery and Corruption

8

Anti-Competitive Practices

8

Code of Ethics

7

Subprocessors

8

Cyber Insurance

8

Data Processing Agreement

8

Cookies

7

Data Breach Notifications

5

Data Out of System

7

Data Access

4

Logging

7

Password Security

7

Status Monitoring

7

Amazon Web Services

7

Anti-DDoS

7

Disk Encryption

8

Endpoint Detection & Response

8

Threat Detection

7

Firewall

4

IDS/IPS

4

Security Information and Event Management

4

Asset Management Practices

6

Email Protection

6

Employee Training

7

Acceptable Use Policy

7

Access Control Policy

6

Anti-Malicious Software Policy

7

BitSight

6

Security Headers

3

We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.

Data Access/Impact Levels

6

Risk Assessments

6

Supply Chain Risk Management

6

We have strict asset management policies in place to ensure that all assets are accounted for and secure.

We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.

Employee Privacy Training

1

Phishing Training

1

Secure Development Training

1

We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.

We have physical and environmental controls in place to ensure that our data centers are secure and reliable.

We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.

Critical Security Update (Resolved)

Vulnerabilities

NGP VAN

CyberGrants

Apricot/ETO

EveryAction

OneCause

DonorDrive

Network for Good

Bonterra Que

This notice closes out our prior Critical Security Update regarding the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. All affected externally facing exposure associated with these vulnerabilities has been fully remediated. The protective controls referenced in our initial notice, including web application firewall mitigations, remain in place as an additional layer of protection. Throughout our review and remediation, continuous monitoring and investigation identified no indicators of compromise on any of Bonterra’s systems and no evidence of unauthorized access to customer data. No action is required by customers, and we consider this matter resolved.

October 22, 2026
Trust Center - Public
Bonterra is aware of the critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 and are actively reviewing our environments for affected systems. We have protective controls in place, including web application firewall mitigations, to reduce the risk of exploitation. There are no indicators of compromise on any of Bonterra’s systems, and we are in the process of remediating any systems that are subject to this notice.