Trust

Security at Volunteer Ledger

Last updated October 21, 2026

This page is an honest, plain-language overview of how we protect your agency's data. We describe only what we actually do: no inflated claims and no certifications we don't hold. Volunteer Ledger is operated by MortonApps LLC.

Encryption in transit and at rest

In transit: all traffic between your browser and the service is encrypted over HTTPS (TLS).
At rest: your data is stored on Cloudflare's managed database (D1) and storage, which encrypt data at rest. If your agency configures its own email credentials, those are additionally encrypted with AES-GCM before being stored.

Authentication and sessions

Passwords are hashed with PBKDF2-HMAC-SHA256 using a per-user random salt. We cannot see or recover your password.
Each person sets their own password from a single-use invite or reset link; admins never type or see another user's password.
Sessions are server-side: the session record lives in our database, and the browser only holds an HttpOnly cookie that scripts cannot read. The session token is stored hashed, so a database leak does not expose usable tokens.
Passwords are checked by Volunteer Ledger itself or, if your agency turns on Sign in with Microsoft, by Microsoft.
Optional two-step sign-in: anyone who signs in with a password can add a code from an authenticator app (such as Microsoft Authenticator or Google Authenticator), with one-time recovery codes for a lost phone. An agency’s admins can require it for admins, for all staff, or for everyone who signs in. People who sign in with Microsoft use Microsoft’s own two-step and your organization’s Microsoft sign-in policies instead.
The authenticator key is stored encrypted and recovery codes are stored only as hashes. A code can’t be used twice, each sign-in allows only a few tries, attempts from one network are limited, and after 10 wrong codes in a row two-step sign-in for that account pauses for 15 minutes. An admin can reset two-step for someone who lost their phone, and the reset is logged.

Access controls and isolation

Role-based access within each agency: admin, staff, and read-only viewer roles limit who can see and change what. An optional volunteer self-login role can only log its own hours.
Kept separate: each customer's data lives in its own workspace, and every database query is limited to that customer.
Audit trail: each hour entry records who created or changed it.

Uploaded documents

Staff only: administrators and staff can open and download a volunteer’s documents. Read-only viewers cannot, even though they can see the volunteer record and requirement status. The restriction is applied on the server, not by hiding a button.
Every access is logged: each download and each deletion writes an entry naming the user and the time it happened.
Allowlist, not blocklist: only fifteen document and image formats are accepted, and the file’s actual content is inspected rather than trusting the type the browser declares. Formats that can carry code, such as web pages and scalable vector graphics, are refused.
Served safely: anything that is not an image or a portable document is sent as a download rather than displayed, with content-type sniffing disabled.
Size limits: 25 MB per file and 5 GB per agency.
Deleted, not hidden: when a document is removed, or when an optional retention window elapses after a volunteer is deactivated, the stored file is destroyed and the deletion is logged.

Hosting and backups

The application runs on Cloudflare's global network (Cloudflare Pages and Functions), with data in Cloudflare D1.
The database benefits from Cloudflare's automatic platform-level backups for its managed D1 service, and we additionally keep our own encrypted, off-site backups in Amazon Web Services (Amazon S3) for disaster recovery. Your agency can also export its records to CSV at any time; we recommend exporting periodically as your own independent copy.
There are no third-party tracking or advertising scripts on this site or in the app. Our app privacy notice explains what the phone and tablet app keeps on the device.

How we handle your data

We collect only what the service needs to run, and we never sell data, never run ads, and never use customer data to train AI models, except as our AI provider’s terms allow for content it flags for safety review (see our Privacy Policy).
Your agency owns its data and can export or request deletion of it at any time. See our Privacy Policy and Data Processing Addendum for the details.
If we ever discover a breach involving your data, we will notify affected agencies without undue delay.

What we don't claim

We want to be straight with you: Volunteer Ledger is a small, focused product. We are not currently SOC 2, ISO 27001, or HIPAA certified, and we don't claim to be. Our security model is built on keeping the product simple, the attack surface small, and PHI out of the system by design. No internet service can promise perfect security, but we design conservatively and tell you the truth about what we do.

Reporting a concern

If you have a security question, or believe you've found a vulnerability, please email [email protected]. We read it during business hours and respond to security reports as quickly as we can. It is not for emergencies: if anyone is in danger, call 911.

Please don’t email us confidential or sensitive information, such as volunteer health or background-check results, or ID or license numbers. If you send it anyway, we’ll keep it confidential and delete it when we no longer need it.