Trust and data
Forward this page to whoever asks the hard questions
Everything below is how Paytron is built, not a policy we intend to write. If any of it matters to your data protection officer, your finance lead or a trustee, this is the page to send them.
Where the data lives, and who can reach it
UK region, for media and personal data alike
Photos, video, donor records and grantee contact details stay in the UK or EU. Nothing about a donor or a grantee is written to application logs, or sent to a third party beyond what the feature itself needs.
One foundation cannot see another, enforced by the database
Isolation is a row-level security policy on every table, not a filter in application code that a bug could skip. An automated suite runs on every change and checks that a member of staff at one foundation, an anonymous visitor and a signed-in donor each see only what they should, table by table.
Grantees never get an account
A community group gets a personal link that lasts seven days and works on the one device that opens it. Nothing to create, no password to lose, and a forwarded link opens a request for a new one rather than somebody else's draft.
Consent comes before content, every time
The group that did the work decides who sees it, at the moment they share it. That choice is stored with the update and enforced everywhere it could be shown.
Four levels, chosen by the grantee
Foundation staff only, the fund's holders, everyone whose gift reached the grant, or the public. An update is never shown beyond the level the group chose.
Safeguarding holds it automatically
Any safeguarding flag forces the update to held. Approving one takes a recorded reason and the reviewer's initials, and it can never publish on its own.
Withdrawal is honoured, not queued
A grantee can withdraw an update after sending it. The media comes down and it stops being shown, without anyone at the foundation having to action it.
Donors can take their data and go
Any donor can download everything held about them, or delete their account. Which grants their past gifts funded stays, with their name replaced by a code, so your accounts still add up.
Where AI is used, and where it is not
Suggests onlyAI drafts a headline and a short summary from the grantee's own answers, and screens images for anything that might identify a child. That is the whole of it. It cannot publish, email, or decide anything.
A named person approves every word. Nothing AI-generated reaches a donor or a public page without a member of your team approving it, and their name is stored against it.
The reviewer sees what changed. Words the AI added that are not in the grantee's answers are highlighted, so a reviewer checks the invented ones rather than reading past them.
Every call is logged. Which prompt version ran, when, and against which update, so a decision can be traced back a year later.
The figures your finance lead will ask about
Attribution is append-only, and it reconciles
A share is never edited. A correction is a new offsetting entry, so the history stays intact and auditable. Every grant payment's shares sum to exactly 100 per cent and to the payment in pence, with no rounding drift, and that property is held at full test coverage.
Statutory money never appears in an individual's feed
Grants from statutory funds attribute to the institutional funder. No individual donor is ever shown a share of public money, and the rule is enforced in the database rather than left to a reviewer to remember.
A fund statement is not published until finance signs it
Period figures come from Xero or a balances file. A public fund page shows nothing until the period is signed off, and each fund controls whether its figures are hidden, summarised or shown in full.
What we have not done yet
We would rather you heard this from us than found it in procurement. Paytron has no external security audit and no formal certification yet: [CERTIFICATION STATUS]. Our data protection impact assessment notes are available on request, and we will complete your own supplier questionnaire.
Named contact for data protection questions: [DPO NAME AND EMAIL].
Or send this page on. It is written to be forwarded.