The honest answer is that it depends less on Altru’s forms than on everything around them. The payment piece of an Altru web form is handled by Blackbaud’s hosted infrastructure and its payment processing, which is built to card-industry standards. The weak spots, when there are any, usually sit on your side: the website page that holds the form, the scripts loaded on that page, who can sign in to Altru, and what happens to the data after it lands.
Below is how I’d break down the question for a board member, an auditor, or a nervous finance director.
Split the question in two
Security for an online ticket, membership, or donation form is a shared job. It helps to be clear about which half belongs to whom.
What Blackbaud carries
- Hosting and infrastructure. Altru is a cloud product. Blackbaud runs the servers, the database, patching, and encryption in transit for the forms it serves.
- Card handling. Card payments through Altru go through Blackbaud’s payment processing (Blackbaud Merchant Services). The goal of that setup is that full card numbers are not stored in your Altru database or handled by your own web server.
- Compliance paperwork. Blackbaud maintains PCI DSS compliance for its payment services. You can ask Blackbaud for the current attestation of compliance rather than relying on a marketing page or a forum answer, including this one.
What stays with you
- The host page. If the form is embedded in your WordPress, Drupal, or Squarespace site, that page needs HTTPS everywhere, current plugins, and a short list of people with admin access.
- Third-party scripts. Analytics tags, chat widgets, pixel trackers, and A/B testing tools all run on the page where the form lives. A compromised script on a payment page is one of the most common ways card data gets skimmed. Recent versions of PCI DSS put much more attention on exactly this, so trim what loads on checkout and donation pages to what you actually need.
- Your PCI responsibilities. Even with a hosted processor, your organization usually still completes a self-assessment questionnaire for your merchant account. Which form applies depends on how payment fields reach the browser. Ask your processor which one fits your setup instead of guessing.
- Staff access to Altru. Altru sign-in runs through Blackbaud ID. Require two-step verification for every user, remove departed and seasonal staff promptly, and review security roles so only people who need revenue and constituent data can see it.
- Data after the transaction. Query exports, spreadsheets on shared drives, and lists emailed to vendors are where a lot of real-world exposure happens. A secure form doesn’t help much if its results end up in an unprotected file.
The threat most organizations actually see: card testing
Donation forms with no minimum amount are a favorite target for card testers. Someone with a batch of stolen card numbers runs dozens or hundreds of tiny gifts to see which cards work. You find out when your revenue shows a string of one-dollar donations from strangers, followed by chargebacks and processing fees.
What to do about it:
- Watch for the pattern. A simple revenue query for small online gifts in the last week, sorted by date and time, makes a burst easy to spot.
- Set a sensible minimum gift on public donation forms if your form setup allows it.
- Ask about bot protection. I’m not certain what CAPTCHA or rate-limiting options are available on every type of Altru form, and it may have changed. Ask Blackbaud support what protections apply to your forms and processor account, and whether fraud filters can be adjusted on the processing side.
- Clean up afterward. Refund or void the test transactions according to your finance policy, and remove the junk constituent records they created so they don’t pollute your mailing lists.
Smaller habits that matter
- Don’t collect what you don’t need. Custom questions on a form are stored with the record. Avoid asking for things like dates of birth or ID numbers unless there’s a clear reason.
- Keep confirmation emails plain. Order details and a ticket barcode are fine. Anything more personal than that doesn’t belong in an email.
- Link to forms from your own site. If members and donors learn to reach your forms from your website rather than from random emails, they are harder to fool with a look-alike phishing page.
- Test after changes. When you edit a form or the page that embeds it, run a real test transaction and confirm the page loads over HTTPS with no browser warnings.
About Blackbaud’s past incident
Someone on your board may bring up the widely reported 2020 ransomware incident at Blackbaud. It’s a fair thing to ask about. The useful response is not to argue about it, but to ask Blackbaud directly what has changed since, what certifications and audits they currently hold, and how they would notify you of a future incident. Keep their answers on file with your vendor risk documentation.
Questions worth sending to Blackbaud
- Can you share your current PCI DSS attestation of compliance for the payment services we use?
- Which PCI self-assessment questionnaire do you recommend for our form setup?
- What bot and card-testing protections apply to our public forms, and what can we adjust?
- Can we require two-step verification for all of our Altru users?
- What is your incident notification process and timeline for customers?
Quick answers
Are card numbers stored in Altru?
Card payments are handled through Blackbaud’s payment processing rather than stored as full numbers in your database. Confirm the details for your account with Blackbaud if an auditor needs it in writing.
Is it safe to embed an Altru form on our website?
Generally yes, as long as your site runs on HTTPS and you keep unnecessary scripts off that page. The embedding page is part of the security picture, so treat it with the same care as the form.
