Security
Security and privacy
A mosque that uses MasjidHQ trusts us with its donors’ information. Here is how money moves, how we protect your data, and what we will never do.
MasjidHQ is in its pilot, and some features arrive during the pilot. Before your mosque commits, we’ll show you what’s ready.
Payments
Donors pay on Stripe’s secure payment page. Card and bank details go straight to Stripe, and MasjidHQ never sees or stores full card numbers.
Each gift is a payment on your mosque’s own Stripe account, and Stripe pays it out to your mosque’s bank account. MasjidHQ never holds donor funds.
Your data
- Data is encrypted in transit with TLS and at rest with AES-256.
- MasjidHQ runs on Supabase for its database and Vercel for its web app.
- We keep personal information out of our logs.
- Your data is backed up every day, and we practice restoring it.
Access
Your team signs in with a link or an 8-digit code sent by email, so there are no passwords to forget. Owners and treasurers also use an authenticator app. If someone loses their phone, we reset it only after confirming who they are, by phone or in person.
There is no public sign-up. We add each person at your mosque’s request, with one of four roles:
| Role | What they can do |
|---|---|
| Owner | Everything for your mosque. |
| Treasurer | Gifts, funds, receipts, and exports. |
| Staff | Enter gifts and donor details. No exports. |
| Board viewer | Totals and reports only. No donor contact details. |
Every change your team makes is recorded in an audit log.
Your rights
- Export all your data as CSV at any time: donors, gifts, fund allocations, and receipts.
- Ask us to delete your data, and we’ll confirm in writing when it’s done.
- If a government agency or anyone else asks us for your data, we require valid legal process, such as a subpoena or court order, and we tell your mosque unless the law forbids it.
What we never do
- We never hold your mosque’s money.
- We never see or store full card numbers.
- We never sell or rent your data, or share it for advertising.
- We never use ad trackers or collect location data.
- We never hand over data without valid legal process.
Report a security problem
If you find a security problem in MasjidHQ, email security@masjidhq.net with the steps to reproduce it. We reply within two business days.
While you look into it, please:
- Don’t access, change, or delete data that isn’t yours.
- Don’t run tests that could disrupt the service, such as denial-of-service attacks or spam.
- Give us reasonable time to fix the problem before you share it.
We don’t offer paid rewards, but we’re grateful for every report. Our security contact is also published in our security.txt file.