Define the release decision
A verified donor extract must remain available through fundraising review, audit and later donor inquiry without turning a laptop or sync folder into the only recoverable copy.
Create a bounded encrypted archive while keeping editable working files, credentials and recovery material separate.
Run the control sequence
- 01Test the current software release with fictional donation extracts on a supported Windows system.
- 02Import only manifest-approved files and inspect temporary folders for plaintext copies.
- 03Lock, reopen and compare file counts and selected checksums with the source manifest.
- 04Store a separately controlled recovery copy and keep credentials away from the archive media.
- 05Record archive identifier, software version, custodian, recovery location and next test date.
Preserve enough evidence
Record the donor extract identifier, fundraising cycle, source device or system, export date, manifest, responsible custodian, authorized recipients, key location, encryption environment, recovery result, retention rule and next review date. Do not put passwords, recovery secrets or unnecessary donor details in the decision record.
Keep the manifest, custodian, approved recipient, key-separation decision, restore result and retention owner together without copying donor details into the record.
Keep surrounding controls visible
An encrypted archive does not replace endpoint security, authorized recipient permissions, a separately stored backup or a tested recovery method.
Donor-export preparation can create extra copies on tablets, laptops, removable media, synchronization folders and recipient devices. The archive owner must address those copies separately and verify the current software release before relying on product behavior.
Questions to ask
Should the archive password travel with the donor extract?
No. Send the archive and its credential through separate approved channels, and verify the authorized recipient before release.
Does encryption make a donor extract accurate or authorized?
No. Encryption restricts file access; it does not establish gift validity, tax treatment, donor consent, recipient authority or gift restrictions.
Primary references
References support specific controls and do not imply endorsement.