How Together protects your donor record
The canonical donor record is the most valuable artefact in fundraising. Together protects it by only accepting writes from sources it trusts - and gives donors a clean way to update their own details when they need to.
The donor record is the most valuable artefact in fundraising. Every ask amount, every disclosure return, every "Hi Sarah, can we have coffee?" depends on it being right. When it's wrong - the wrong name, an outdated address, a phone number that belongs to someone else - your asks misfire, your compliance filings carry bad data, and your team loses confidence in the database.
Together's design rule: your canonical donor record is only modified by writers Together has reason to trust. Everything else gets preserved as a per-donation snapshot for the audit trail, without touching the canonical row.
The case this prevents
Imagine your highest-value supporter, Sarah, gave $20,000 last year. You have her name spelt correctly, her work email, her home address, her mobile.
Tonight, someone donates $5 through your donate form, typing Sarah's email but otherwise leaving every field blank, or filling in some other person's name and address.
That submission is processed: the donation is recorded, Sarah's history grows, the verbatim form fields are preserved as an audit-trail snapshot. But Sarah's canonical name, address, and phone are unchanged. The donor record you've spent years building doesn't get rewritten by a stranger or by a blanked-out form.
The next outreach still finds Sarah. The next disclosure return still has the right identity. The next time you look her up, she's there.
Trust tiers
Every source that can touch a donor record falls into one of four categories. The first three can update the canonical record; the last can't.
| Tier | Who | What they can change |
|---|---|---|
| Staff | An admin or editor in your Together dashboard | Everything. They're authoritative by virtue of being in your org. |
| Receipt confirm | A donor who clicked "Update my details" in their own receipt | Just the fields they confirmed in the receipt confirmation step. |
| Authoritative sync | Your connected CRM (NationBuilder, Raisely) | Whatever fields your CRM-precedence config allows. You chose this CRM as authoritative; this is the contract. |
| Unauthed | Anyone submitting a donate form, pre-fill link or not | Nothing on the canonical record. A per-donation snapshot is saved, but the canonical row stays as it was. |
A pre-fill link is not a trust tier. It fills the form in for the donor; it never writes to the record. Fundraising email gets forwarded, and the person holding a forwarded link is not necessarily the donor it was sent to, so the only donor-initiated change Together accepts is one confirmed from a receipt sent to the address that gave.
A narrow exception exists for compliance accuracy: an unauthed submission may upgrade a donor's classification (e.g. from Individual to Organisation) if it provides that information, because the AEC's classification needs to be correct and the upgrade direction is unambiguously safer. Nothing else in the unauthed path can mutate the record.
Magic links: how legitimate updates still work
A pure "never mutate" rule would lock the record. Donors do move house, get new phone numbers, get married. Together solves this with two emailed magic-link flows: one saves the donor typing, the other is how a change actually lands.
The pre-fill link
When you send a donor a fundraising email and you know who you're emailing, the email's donation link is personalised so it knows who's clicking. When the donor follows it:
- The donate form pre-fills with their details as you hold them. They see what's already on file and don't have to retype it.
- They can edit anything before submitting.
- Nothing they change lands on the record from here. What they typed is kept against that donation, and if it differs from your record their receipt carries the confirm step below.
The link fills the form, is good for one donation, and changes nothing until the donor confirms from their receipt. It is spent by the first submission that reaches payment, even if the payment then fails: a second click - or a click by someone the email was forwarded to - opens an empty form.
Before it is spent, though, the link shows the donor's details to whoever opens it - name, email, phone, address and organisation name - so a supporter who forwards your email to a friend has shown them what you hold. Nothing can be changed from there, and the first submission that reaches payment closes it.
To generate a pre-fill link, open a donation form (Engage -> Forms -> the form) or a recommendation set, switch to the Personalised links tab, search for the donor, and click Generate. Together returns a copyable URL that you paste into your campaign email, CRM mail-merge, or message to that donor. Each link is good for that donor on that form for a short window; if you need a fresh one, generate again.
The link stops working the instant any of:
- The donor donates with it (one use).
- The donor unsubscribes from your marketing.
- You cancel the send it was part of.
- The donor is archived, their email changes, an admin edits their profile, or they're merged with another record.
The receipt-confirm link
This is how every donor-initiated change lands. A donor types their details on the donate form - with a personalised link or without one - and the submission doesn't match what you have on file: new address, new phone. Their canonical record stays unchanged, but you don't want to lose the update either.
Together's donation receipt email includes a call to action: "Some of the details we have for you look out of date. Click to update your record."
When the donor clicks:
- Together shows them the proposed change field-by-field. "Update phone from 0412 345 678 to 0413 555 999."
- The donor sees exactly what's about to change before they confirm.
- If they confirm, Together applies just those changes to the canonical record.
Nothing changes until they actively confirm. If they ignore the email, the canonical record stays as-is and the new details remain available in the per-donation snapshot.
The per-donation snapshot
Even when a submission can't change the canonical record, Together still preserves what the donor typed. Every form-driven donation row carries a snapshot of the verbatim form fields. That's useful for:
- Compliance audit. The AEC asks "what did you have at the moment of the donation?" - the snapshot answers, regardless of how the canonical record has drifted since.
- Support investigations. "Why does this donor have two different addresses on record?" - look at the snapshot history.
- Legitimate manual reconciliation. If you decide a donor's $5 submission really was them and the new details are correct, you can apply it yourself.
You can see the snapshot, and apply it, from the donation itself. Open the donor, go to the Giving tab, and click the eye icon on the gift: the detail panel shows what was submitted with that gift, flags each value that differs from the record today, and an editor or admin can apply them in one click. A couple of things it will show you but not apply: an email address (that one is the donor's identity, and changing it is a staff edit) and a phone number that can't be stored as an Australian number. The values are what someone typed on a form, not something Together verified, so the panel says so and the decision stays yours.
The canonical record stays clean; the audit trail is complete.
Why this matters for your fundraising
The trust model is invisible most of the time. Donors fill in forms. Money lands. Receipts go out. Your CRM data stays accurate.
It matters when:
- You run a major-gift campaign. Your asks are computed from canonical data. A poisoned record produces a wrong ask and an embarrassed donor manager.
- You file an AEC disclosure return. The CSV pulls from canonical donor identity. A silently-overwritten address ships an inaccurate return.
- A supporter calls you. You look them up by name and you find them. You don't find a stranger who once donated $5.
- A regulator or your board audits your data. Every change to a donor has a known source. There's no "I don't know who edited this."
This is one of the reasons Together exists. Compliance and fundraising both depend on a donor record that's accurate by construction, not just by hope.
What to do next
- Walk the duplicate queue to clean up any pre-existing fragmented records: Merge duplicate donors.
- Connect your CRM if you want it to be the authoritative source for your org: Connect NationBuilder or Connect Raisely.