HarvestDesk
Security & Infrastructure
Your ministry’s information deserves careful protection. Separate workspaces, controlled access and two-step verification help keep the right information with the right people.
Separate Organisation Workspaces
Each organisation has its own dedicated workspace. Isolation is enforced at the database level with per-record access rules, so records are never shared across organisations. The same rules apply whether records are viewed directly or read by the Smart Assistant.
Smart Assist Privacy and Model Training
Your ministry’s data stays yours. Organisation records, field reports, donor details, research briefings and Smart Assistant conversations are not used to train public or foundation models.
Access Based on Responsibilities
Organisation administrators manage access by role and individual. Country-scoped records limit information to a staff member’s assigned territory, with regional or global access only where authorised. Access to the Smart Assistant does not bypass these permissions.
Two-Step Verification
HarvestDesk supports two-step verification using email codes or an authenticator app. Organisations choose their verification method. Staff should keep sign-in details private and tell their administrator when access is no longer needed.
Encrypted Integrations and Credentials
When organisations connect services such as Microsoft 365, Google Workspace, payment providers or their own video account, credentials and sign-in tokens are stored encrypted. They are used only by server-side functions and are never sent to the browser.
Sensitive Research and Confirmed Actions
Research observations can use Public, Team or Confidential security tiers. The Smart Assistant prepares actions for review but cannot save or change records until a team member confirms. HarvestDesk can also switch assistant capabilities off across organisations.
Managed Cloud Infrastructure
HarvestDesk runs on enterprise cloud infrastructure whose providers maintain independently audited SOC 2 Type II and ISO 27001 controls. All traffic is encrypted in transit with HTTPS. Code, access rules and software dependencies are security-scanned before release.
Your Organisation’s Responsibilities
Administrators should regularly review staff access, remove access for departing staff, and give people only the permissions they need. Take care when exporting documents or sharing public prayer, giving and registration links. No online service can promise that every security risk is eliminated.
Privacy and Security Questions
Our Privacy Policy explains data use, sharing, security and your rights. Our Terms & Conditions explain responsibilities. This page is HarvestDesk’s overview, not an independent security certification.
For security questions or to report a concern, email support@harvestdesk.org. Please do not include passwords, access tokens or confidential records.