Skip to main content
Security & trust

Donor data, payment rails, and shelter operations — built on the same infrastructure banks use.

Bloom is a small, senior team that owns every system end-to-end. Below is the plain-English version of how we protect your shelter, your donors, and the money that moves between them.

Last reviewed April 24, 2026
PCI-DSS Level 1 processors

Stripe + PayPal/Braintree handle all card data. Bloom never sees a PAN.

Encrypted everywhere

TLS 1.3 in transit. AES-256 at rest. No raw secrets in app code.

Row-level security

Postgres RLS isolates every shelter’s data at the database layer.

Audit-logged access

Every admin action is recorded with actor, target, and timestamp.

Bloom is the operating platform for animal shelters — websites, donations, donor CRM, email, SEO, ads, campaigns, and AI tooling, all in one stack. That means the same system holds the org's public site, its donor list, its payment flows, and its outbound communications. We take that responsibility seriously, and we don't outsource the parts that matter.

1. Payment infrastructure

Bloom does not process payments directly. All cards, bank accounts, and digital wallets are tokenized and processed by Stripe and PayPal/Braintree — both certified PCI-DSS Level 1, the highest tier of the Payment Card Industry Data Security Standard.

  • No raw card data on Bloom servers. Card details are entered into a hosted iframe served by the processor and tokenized before they leave the donor's browser. We never see, log, or store a primary account number (PAN), CVV, or full bank routing pair.
  • Two redundant rails. Bloom integrates with both Stripe and PayPal/Braintree. If one rail experiences degraded service, donations can be routed to the other without any code changes by the shelter.
  • Apple Pay, Google Pay, PayPal, Venmo. Donors can pay with any wallet supported by the underlying processors. Wallet payments are tokenized at the device level and never decrypt on Bloom infrastructure.
  • 3-D Secure & SCA. When a card issuer requests step-up authentication, Bloom defers to the processor's 3-D Secure flow. Strong Customer Authentication (SCA) is honored for European cards.
  • Fraud screening. Bloom relies on the processors' native risk engines (Stripe Radar, Braintree Risk Threshold Rules) and adds platform-level velocity limits and anomaly detection on top.
  • Direct payouts to the shelter. Funds settle to the shelter's connected account, not to a Bloom pool. Bloom does not custody donations and does not function as a money transmitter.

For SAQ-A scope confirmation or processor attestation letters, contact [email protected].

2. Data security

  • Encryption in transit. All traffic to and from Bloom uses TLS 1.2 or higher (TLS 1.3 preferred). HSTS is enforced on every Bloom-hosted domain.
  • Encryption at rest. Production data is stored in AES-256 encrypted Postgres volumes managed by Supabase, backed by AWS-managed keys. Object storage (donor receipts, animal photos, page assets) is also AES-256 encrypted.
  • Database isolation. Bloom uses Postgres row-level security (RLS) to scope every query to the requesting organization. No shelter can read, write, or even enumerate another shelter's rows — this is enforced at the database layer, not just in app code.
  • Secrets management. API keys, webhook secrets, and processor credentials live in encrypted environment vaults. Secrets are never committed to source control, and key rotation runs through documented runbooks.
  • Backups. Daily automated snapshots with point-in-time recovery for the last 7 days at minimum. Backups are encrypted and stored in a separate region from the primary database.
  • No third-party data sale. Donor data is never sold, rented, or shared with third parties for their marketing. See the Privacy Policy for the full breakdown.

3. Access & authentication

  • Authenticated by Supabase Auth. Email + password with bcrypt-hashed credentials. Magic-link sign-in available for low-friction access on shared devices.
  • Two-factor authentication (2FA). TOTP-based 2FA is available for all admin accounts and enforced for sensitive operations (payment configuration, payout setup, member privilege changes).
  • Role-based access control. Each organization defines its own admin, editor, and viewer roles. Privilege escalation requires an existing admin to approve.
  • Audit logs. Every privileged action — page edits, donor exports, payout configuration, member invites, integration changes — is recorded in an append-only audit log visible to the organization's admins.
  • Session security. Sessions are issued as HttpOnly, Secure, SameSite=Lax cookies and rotate on privilege change. Inactive sessions expire automatically.
  • Internal access. Bloom team members access customer data only with documented, audit-logged justification (typically a support ticket the shelter opened). Production access is limited to the founding team.

4. Infrastructure & hosting

  • Application tier: Vercel (SOC 2 Type II, ISO 27001, PCI-DSS attested). Edge runtime + serverless functions, hardened by Vercel's shared-tenant security model.
  • Database tier: Supabase on AWS (SOC 2 Type II, HIPAA-eligible offering, ISO 27001). Primary region in the United States with cross-region backups.
  • DNS & edge: Cloudflare for DNS, DDoS protection, and WAF. Cloudflare automatically blocks the most common attack patterns (SQLi, XSS, credential stuffing, OWASP top 10).
  • Email delivery: Customer.io for transactional and marketing email, with DKIM, SPF, and DMARC configured per Bloom-issued sending domain.
  • Observability: Application logs, request traces, error events, and slow-query traces are collected centrally with PII redaction.

5. Monitoring & operations

  • Uptime target: 99.9% rolling 30-day availability for the donation surface and shelter admin.
  • Health checks: Continuous synthetic checks on the donate flow, login flow, and admin dashboards. On-call alerts trigger within minutes of degradation.
  • Incident response: A documented runbook governs detection, containment, customer communication, and postmortem. Material incidents are reported to affected shelters within 72 hours, in line with industry best practice and applicable breach-notification laws.
  • Change management: All production changes ship through pull requests with automated tests, type checks, and a staging preview before promotion.
  • Dependency hygiene: Automated security advisories on every npm dependency, with high-severity vulnerabilities patched within 7 days of disclosure.

6. Compliance & privacy

  • PCI-DSS scope: Bloom operates as a SAQ-A merchant relative to the card networks — all card data capture, storage, and processing is delegated to Stripe and PayPal/Braintree, both PCI-DSS Level 1 service providers.
  • Privacy law: Bloom complies with the CCPA/CPRA (California), GDPR (EU/EEA visitors), and U.S. state-level privacy laws. Donor data export and deletion requests are honored within statutory windows.
  • SOC 2 Type II: on the roadmap. We're building toward SOC 2 audit readiness as the platform scales beyond the initial cohort. In the meantime, Bloom inherits SOC 2 controls from its primary sub-processors (Vercel, Supabase, Stripe, Braintree, Cloudflare, Customer.io).
  • Accessibility: Bloom-built shelter sites target WCAG 2.1 Level AA. Accessibility issues are treated as bugs, not feature requests.
  • Data residency: Production data is stored in U.S. regions. International data residency is available for larger orgs on request.
  • Subprocessors list: Available on request to [email protected].

7. Vulnerability disclosure

We welcome reports from security researchers and shelter staff who find issues in Bloom. Send findings to [email protected]. Please give us a reasonable window to investigate and patch before public disclosure.

  • In scope: bloompact.ai, any *.bloompact.ai subdomain owned by Bloom, the legacy bloomgiving.org and bloomen.ai domains and their subdomains, and Bloom-managed shelter sites on custom domains.
  • Out of scope: social engineering, physical attacks, denial-of-service, third-party services we don't control (Stripe, PayPal, Vercel, Supabase, Cloudflare, Customer.io).
  • Safe-harbor commitment. We will not pursue legal action against good-faith researchers who follow responsible disclosure and avoid privacy violations, service disruption, and data destruction.

Suspect a payment issue or fraud? Email [email protected] with the donation ID and we'll get a founder on it same-day.

8. For risk & underwriting teams

If you're a payment-processor risk team, banking partner, foundation grantmaker, or enterprise procurement reviewer, we can provide:

  • Processor attestation of PCI-DSS scope (SAQ-A).
  • Subprocessor list with current SOC 2 / ISO certificates.
  • Data Processing Addendum (DPA) and standard contractual clauses for international partners.
  • Sample audit-log export and access-control matrix.
  • Architecture overview — deployed regions, data flow, trust boundaries.

Contact [email protected] or schedule a call directly with a founder via the contact page. We aim to respond to risk-team requests within one business day.

Bloom One LLC is a Delaware limited liability company doing business as Bloom.