How Together protects your donor record
The canonical donor record is the most valuable artefact in fundraising. Together protects it by only accepting writes from sources it trusts - and gives donors a clean way to update their own details when they need to.
The donor record is the most valuable artefact in fundraising. Every ask amount, every disclosure return, every "Hi Sarah, can we have coffee?" depends on it being right. When it's wrong - the wrong name, an outdated address, a phone number that belongs to someone else - your asks misfire, your compliance filings carry bad data, and your team loses confidence in the database.
Together's design rule: your canonical donor record is only modified by writers Together has reason to trust. Everything else gets preserved as a per-donation snapshot for the audit trail, without touching the canonical row.
The case this prevents
Imagine your highest-value supporter, Sarah, gave $20,000 last year. You have her name spelt correctly, her work email, her home address, her mobile.
Tonight, someone donates $5 through your donate form, typing Sarah's email but otherwise leaving every field blank, or filling in some other person's name and address.
That submission is processed: the donation is recorded, Sarah's history grows, the verbatim form fields are preserved as an audit-trail snapshot. But Sarah's canonical name, address, and phone are unchanged. The donor record you've spent years building doesn't get rewritten by a stranger or by a blanked-out form.
The next outreach still finds Sarah. The next disclosure return still has the right identity. The next time you look her up, she's there.
Trust tiers
Every source that can touch a donor record falls into one of five categories. The first three can update the canonical record; the others can't.
| Tier | Who | What they can change |
|---|---|---|
| Staff | An admin or editor in your Together dashboard | Everything. They're authoritative by virtue of being in your org. |
| Verified token | A donor who clicked an emailed prefill link before donating | Profile fields (name, phone, address, employer, occupation), once Stripe accepts the payment. |
| Receipt confirm | A donor who clicked "Update my details" in their own receipt | Just the fields they consented to in the receipt confirmation step. |
| Authoritative sync | Your connected CRM (NationBuilder, Raisely) | Whatever fields your CRM-precedence config allows. You chose this CRM as authoritative; this is the contract. |
| Unauthed | A donor submitting a donate form with no verified link | Nothing on the canonical record. A per-donation snapshot is saved, but the canonical row stays as it was. |
A narrow exception exists for compliance accuracy: an unauthed submission may upgrade a donor's classification (e.g. from Individual to Organisation) if it provides that information, because the AEC's classification needs to be correct and the upgrade direction is unambiguously safer. Nothing else in the unauthed path can mutate the record.
Magic links: how legitimate updates still work
A pure "never mutate" rule would lock the record. Donors do move house, get new phone numbers, get married, change employers. Together solves this with two emailed magic-link flows.
The pre-fill link
When you send a donor a fundraising email and you know who you're emailing, the email's donation link is personalised so it knows who's clicking. When the donor follows it:
- The donate form pre-fills with their canonical details. They see what's already on file.
- They can edit anything before submitting. The form trusts that you've authenticated their email by sending the link there.
- After Stripe accepts the payment, Together applies the changes to the canonical record.
Email control is the authentication signal. If the donor's mailbox is theirs, the link is theirs.
The link is revoked the instant any of:
- The donor is archived.
- The donor's email changes.
- An admin edits the profile in the dashboard.
- The donor is merged with another record.
The receipt-confirm link
The harder case: a new or returning donor types their details on the donate form without a personalised link. Their submission doesn't match what you have on file - new address, new phone. Their canonical record stays unchanged, but you don't want to lose the update either.
Together's donation receipt email includes a call to action: "Some of the details we have for you look out of date. Click to update your record."
When the donor clicks:
- Together shows them the proposed change field-by-field. "Update phone from 0412 345 678 to 0413 555 999."
- The donor sees exactly what's about to change before they confirm.
- If they confirm, Together applies just those changes to the canonical record.
Nothing changes until they actively confirm. If they ignore the email, the canonical record stays as-is and the new details remain available in the per-donation snapshot.
The per-donation snapshot
Even when a submission can't change the canonical record, Together still preserves what the donor typed. Every form-driven donation row carries a snapshot of the verbatim form fields. That's useful for:
- Compliance audit. The AEC asks "what did you have at the moment of the donation?" - the snapshot answers, regardless of how the canonical record has drifted since.
- Support investigations. "Why does this donor have two different addresses on record?" - look at the snapshot history.
- Legitimate manual reconciliation. If you decide a donor's $5 submission really was them and the new details are correct, the snapshot is right there to copy into a staff-tier update.
The canonical record stays clean; the audit trail is complete.
Why this matters for your fundraising
The trust model is invisible most of the time. Donors fill in forms. Money lands. Receipts go out. Your CRM data stays accurate.
It matters when:
- You run a major-gift campaign. Your asks are computed from canonical data. A poisoned record produces a wrong ask and an embarrassed donor manager.
- You file an AEC disclosure return. The CSV pulls from canonical donor identity. A silently-overwritten address ships an inaccurate return.
- A supporter calls you. You look them up by name and you find them. You don't find a stranger who once donated $5.
- A regulator or your board audits your data. Every change to a donor has a known source. There's no "I don't know who edited this."
This is one of the reasons Together exists. Compliance and fundraising both depend on a donor record that's accurate by construction, not just by hope.
What to do next
- Walk the duplicate queue to clean up any pre-existing fragmented records: Merge duplicate donors.
- Connect your CRM if you want it to be the authoritative source for your org: Connect NationBuilder or Connect Raisely.