SaaS Ranking
Menu

Donorbox

donorbox.org · Nonprofit fundraising · checked 2026-09-03

30/100EBand E

Rank 8 of 17 in Nonprofit fundraising, where the median is 30.

We measured 12 of 12 criteria for Donorbox on 2026-09-03. We found 4 with a source and did not find 8 at the addresses we checked. That is a transparency score of 30 out of 100, band E.

Overview

Transparency labelsaas-ranking.com

Donorbox

donorbox.org · Nonprofit fundraising

  1. A
  2. B
  3. C
  4. D
  5. E
  6. F
E 30of 100 Rank 8 of 17

Published commitments3 of 9 found

Measured behaviour1 of 3 found

Checked 2026-09-03. Every line links the page we found it on. A cross means we found nothing at the addresses we checked, not that the vendor has no such document. A transparency score, not a product rating.

We do not issue badges: a badge is the first step towards a paid placement, and there is none here. The SVG is a document with the date in it, for your own files.

The label is the whole measurement in one object: every criterion with its weight, the band, and the date. Public transparency score, not a product or security rating.

Every line in it links the page we found the result on, or lists the addresses we checked. A cross means we found nothing there, not that Donorbox has no such document.

Gaps, heaviest first

✗

Data processing agreement

weight 3 of 3

No data processing agreement found.

Checked 8 addresses on 2026-09-03.

Show the 8 addresses we checked
  1. https://donorbox.org/legal/dpa – reached, no match (HTTP 404)
  2. https://donorbox.org/dpa – reached, no match (HTTP 404)
  3. https://donorbox.org/legal/data-processing-agreement – reached, no match (HTTP 404)
  4. https://donorbox.org/data-processing-agreement – reached, no match (HTTP 404)
  5. https://donorbox.org/legal/data-processing-addendum – reached, no match (HTTP 404)
  6. https://donorbox.org/legal/gdpr – reached, no match (HTTP 404)
  7. https://donorbox.org/trust/dpa – reached, no match (HTTP 404)
  8. https://donorbox.org/privacy/dpa – reached, no match (HTTP 404)

Is this wrong? Send us the URL

✗

Subprocessor list

weight 3 of 3

No subprocessor list found.

Checked 7 addresses on 2026-09-03.

Show the 7 addresses we checked
  1. https://donorbox.org/legal/subprocessors – reached, no match (HTTP 404)
  2. https://donorbox.org/subprocessors – reached, no match (HTTP 404)
  3. https://donorbox.org/sub-processors – reached, no match (HTTP 404)
  4. https://donorbox.org/legal/sub-processors – reached, no match (HTTP 404)
  5. https://donorbox.org/trust/subprocessors – reached, no match (HTTP 404)
  6. https://donorbox.org/privacy/subprocessors – reached, no match (HTTP 404)
  7. https://donorbox.org/legal/subprocessor-list – reached, no match (HTTP 404)

Is this wrong? Send us the URL

✗

Status page with history

weight 2 of 3

No public status page found.

Checked 3 addresses on 2026-09-03.

Show the 3 addresses we checked
  1. https://status.donorbox.org/ – The name "status.donorbox.org" could not be resolved.
  2. https://donorbox.org/status – reached, no match (HTTP 404)
  3. https://donorbox.org.statuspage.io/ – Could not be fetched: fetch failed.

Is this wrong? Send us the URL

✗

HTTPS enforced with HSTS

weight 2 of 3

No enforced HTTPS with HSTS found.

Checked 2 addresses on 2026-09-03.

Show the 2 addresses we checked
  1. http://donorbox.org/ – redirects to https://donorbox.org/
  2. https://donorbox.org/ – no HSTS header

Is this wrong? Send us the URL

✗

No third-party tracking before consent

weight 2 of 3

No consent-free first load found.

Checked 1 address on 2026-09-03.

Show the 1 address we checked
  1. https://donorbox.org/ – third-party requests before any interaction: analytics.twitter.com, api.hubapi.com, api.kiflo.com, bzr.openai.com, bzrcdn.openai.com, cdn.kiflo.com, connect.facebook.net, cta-service-cms2.hubspot.com, donorbox-www.herokuapp.com, forms.hscollectedforms.net, forms.hsforms.com, js.hs-analytics.net, js.hs-banner.com, js.hs-scripts.com, js.hsadspixel.net, js.hscollectedforms.net, js.hubspot.com, js.zi-scripts.com, od-18c216b54e2045bdbb2d2f70bc4834b0.ecs.us-east-2.on.aws, pagead2.googlesyndication.com, perf-na1.hsforms.com, px.ads.linkedin.com, region1.google-analytics.com, snap.licdn.com, static.ads-twitter.com, static.cloudflareinsights.com, t.co, tr.capterra.com, track.hubspot.com, tracking-api.g2.com, tracking.g2crowd.com, ws.zoominfo.com, www.facebook.com, www.googletagmanager.com

Is this wrong? Send us the URL

✗

Notice before subprocessors change

weight 2 of 3

No commitment to give notice before subprocessors change found.

Checked 8 addresses on 2026-09-03.

Show the 8 addresses we checked
  1. https://donorbox.org/legal/subprocessors – reached, no match (HTTP 404)
  2. https://donorbox.org/subprocessors – reached, no match (HTTP 404)
  3. https://donorbox.org/sub-processors – reached, no match (HTTP 404)
  4. https://donorbox.org/legal/dpa – reached, no match (HTTP 404)
  5. https://donorbox.org/dpa – reached, no match (HTTP 404)
  6. https://donorbox.org/legal/data-processing-agreement – reached, no match (HTTP 404)
  7. https://donorbox.org/trust/subprocessors – reached, no match (HTTP 404)
  8. https://donorbox.org/legal/sub-processors – reached, no match (HTTP 404)

Is this wrong? Send us the URL

✗

Uptime SLA with a figure

weight 1 of 3

No uptime figure found.

Checked 6 addresses on 2026-09-03.

Show the 6 addresses we checked
  1. https://donorbox.org/legal/sla – reached, no match (HTTP 404)
  2. https://donorbox.org/sla – reached, no match (HTTP 404)
  3. https://donorbox.org/legal/service-level-agreement – reached, no match (HTTP 404)
  4. https://donorbox.org/trust/sla – reached, no match (HTTP 404)
  5. https://donorbox.org/uptime – reached, no match (HTTP 404)
  6. https://donorbox.org/legal/uptime-sla – reached, no match (HTTP 404)

Is this wrong? Send us the URL

✗

Named privacy contact

weight 1 of 3

No named privacy contact found.

Checked 7 addresses on 2026-09-03.

Show the 7 addresses we checked
  1. https://donorbox.org/legal/privacy – reached, no match (HTTP 404)
  2. https://donorbox.org/privacy – reached, no match (HTTP 200)
  3. https://donorbox.org/privacy-policy – reached, no match (HTTP 200)
  4. https://donorbox.org/legal/privacy-policy – reached, no match (HTTP 404)
  5. https://donorbox.org/legal/privacy-notice – reached, no match (HTTP 404)
  6. https://donorbox.org/trust/privacy – reached, no match (HTTP 404)
  7. https://donorbox.org/datenschutz – reached, no match (HTTP 404)

Is this wrong? Send us the URL

Evidence

The full source lists sit behind these two groups, so that the answer above stays readable.

Published, with a source 4
✓

Data location stated

weight 3 of 3

The hosting location is stated on a public page.

Source: https://donorbox.org/explore/privacy · checked 2026-09-03

✓

Public pricing

weight 2 of 3

Actual numbers on a public page.

Source: https://donorbox.org/pricing · checked 2026-09-03

✓

Certifications named

weight 1 of 3

SOC 2 or ISO 27001 named on a public page.

Source: https://donorbox.org/security · checked 2026-09-03

✓

security.txt (RFC 9116)

weight 1 of 3

Served at /.well-known/security.txt.

Source: https://donorbox.org/.well-known/security.txt · checked 2026-09-03

History

Not enough completed runs yet to draw a line. The next runs fill this in.

Compare