Non-profit security reports

T

The Sooner Club

thesoonerclub.com

62

The Sooner Club website serves as the official online presence for a non-profit athletics support organization established in 2007. It provides membership management, donation processing, and information about athletics projects and events. The site targets members, donors, and athletics supporters, positioning itself as a trusted and established entity within the collegiate athletics community. Technically, the website leverages modern JavaScript frameworks such as KnockoutJS and RequireJS, hosted on Amazon CloudFront CDN, and integrates multiple analytics and marketing tools including Google Analytics and Tag Manager. The site demonstrates good mobile optimization, accessibility, and SEO practices, though performance is moderate due to multiple external scripts. Security posture is solid with HTTPS enforced and secure login portals, but could be improved by enabling DNSSEC and implementing a Content-Security-Policy header. Privacy compliance is addressed with a linked privacy and cookie policy, including a consent mechanism. Overall, the website is professional, trustworthy, and safe for general audiences, with minor technical and security enhancements recommended.

L

Landkreis Böblingen bleibt bunt e.V.

lkbb-bb.de

46

Landkreis Böblingen bleibt bunt e.V. is a German non-profit organization focused on addressing social polarization and promoting inclusive discourse, as reflected in their website content. The organization appears to engage the local community through events and awareness campaigns. The website is built on WordPress using the Astra theme and several plugins including Yoast SEO and Borlabs Cookie for consent management. Hosting is provided by Alfahosting, indicated by the nameservers. The technical infrastructure is modern and supports mobile optimization and SEO best practices. Security posture is adequate with HTTPS enabled and cookie consent implemented, but lacks advanced security headers and published security policies. No privacy policy or terms of service pages were found, which is a compliance gap. Contact information is not explicitly provided on the homepage or in the analyzed content. Overall, the website is professional and trustworthy but could improve in privacy and security transparency.

Bully's Kids Club is a small non-profit organization focused on engaging children through a points and rewards system to encourage positive behavior. The website serves as a portal for registration, login, and access to a prize store, powered by the FanMaker platform. The technical infrastructure relies on a mix of legacy and modern web technologies including AngularJS, jQuery, and various third-party libraries, hosted with Cloudflare DNS and GoDaddy registrar. The site is mobile optimized and uses HTTPS, but lacks advanced security headers and DNSSEC, indicating room for improvement in security hardening. Privacy compliance is basic with a privacy policy present but no cookie consent mechanism or detailed GDPR indicators. No contact or incident response information is provided on the welcome page, which may impact user trust and compliance. Overall, the website is functional and moderately secure but would benefit from modernization and enhanced privacy and security practices.

E

Engagiert am See

engagiert-am-see.de

56

Engagiert am See operates as a regional non-profit volunteer platform serving the Bodenseekreis and the city of Friedrichshafen. The website facilitates volunteer engagement by providing a marketplace for volunteer opportunities and resources for both volunteers and organizations. The platform is positioned as a trusted community resource with a clear focus on social impact and local engagement. Technically, the site is built on Drupal CMS, uses Matomo for privacy-conscious analytics, and incorporates modern web technologies such as Font Awesome and Slick Carousel. The site is mobile optimized and accessible, with a professional design and clear navigation. Security posture is solid with HTTPS enforced and cookie consent implemented, though there is room for improvement in security headers and explicit security policies. Privacy compliance is good, with GDPR-aligned cookie management and a comprehensive privacy policy. Business credibility is supported by consistent branding and trust signals, though direct contact emails and phone numbers are not explicitly published, relying instead on contact forms. Overall, the site presents a trustworthy, well-maintained digital presence for a small non-profit organization.

E

EF2

ef2.nl

54

EF2 is a Dutch creative and digital agency specializing in delivering pragmatic and comprehensive digital solutions primarily for non-profit organizations, wholesale businesses, and service providers. The company positions itself as a specialist agency focused on helping clients grow by rediscovering their strengths and renewing their digital presence. Their key services include strategy and concepting, digital and UX design, development, and SEO optimization. The website reflects a professional and consistent brand image with strong client case studies and technology partnerships, indicating a mature market presence. Technically, the website is built using modern JavaScript frameworks such as Vue.js and Nuxt.js, with integrations for analytics and user behavior tracking via Google Analytics, Hotjar, and Leadinfo. The site is mobile-optimized, fast-loading, and well-structured, demonstrating a high level of digital maturity. However, there is a lack of published privacy and cookie policies, which is a notable compliance gap. From a security perspective, the site uses HTTPS and asynchronous script loading, but lacks visible security headers and published security or incident response policies. No vulnerabilities or exposed sensitive data were detected. The WHOIS data is consistent with the website's claims, reinforcing the legitimacy of the domain and business. Overall, EF2 presents a trustworthy and professional digital agency with room for improvement in privacy compliance and security transparency. Strategic recommendations include publishing comprehensive privacy and cookie policies, implementing security headers, and establishing incident response and vulnerability disclosure mechanisms to enhance trust and compliance.

S

Stichting het Gehandicapte Kind

gehandicaptekind.nl

47

Stichting het Gehandicapte Kind is a well-established Dutch non-profit organization dedicated to supporting children with disabilities by promoting inclusion in education, play, and sports. The website effectively communicates its mission, engages donors and volunteers, and provides clear calls to action. The organization holds recognized certifications such as ANBI and CBF, enhancing its trustworthiness and legitimacy. The domain age and WHOIS data align with the organization's claims, supporting a strong business credibility profile. Technically, the website is built on Drupal 9 and integrates modern tools including Google Tag Manager, reCAPTCHA, Cookiebot for consent management, and analytics platforms like SpotEffects and Leadinfo. The site is mobile-optimized, accessible, and SEO-friendly, providing a good user experience. Security practices include HTTPS enforcement and CAPTCHA protection on forms, though some security headers could be improved for enhanced protection. The security posture is solid with no detected vulnerabilities or exposed sensitive data. Privacy compliance is robust with clear privacy and cookie policies and GDPR adherence. However, the site lacks a published security policy or incident response contact, which could be areas for improvement. Overall, the website presents a professional, trustworthy, and secure platform for its charitable activities, with recommendations to enhance DNS security and security headers to further strengthen its security posture.

S

Stichting Hart voor Zwolle

stichtinghartvoorzwolle.nl

49

Stichting Hart voor Zwolle is a Dutch non-profit organization dedicated to combating loneliness among vulnerable populations in Zwolle, including elderly, refugees, disabled individuals, and youth. The organization mobilizes young volunteers aged 18-35 to engage in meaningful social activities and support, fostering community connections. The website reflects a well-established local presence with a clear mission, active community engagement, and a focus on volunteerism and social inclusion. Technically, the site is built on WordPress with modern plugins and SEO optimizations, hosted by a reputable Dutch provider. Security posture is good with HTTPS and DNSSEC enabled, though additional security headers and formal policies could enhance protection. Privacy compliance is strong with clear cookie consent and privacy policies. Overall, the site is professional, trustworthy, and well-aligned with its non-profit mission.

S

Stichting Hart voor Zwolle

hartvoorzwolle.nl

49

Stichting Hart voor Zwolle is a Dutch non-profit organization dedicated to combating loneliness in the Zwolle community by connecting enthusiastic young volunteers (aged 18-35) with vulnerable groups including elderly, refugees, people with disabilities, and homeless individuals. The organization facilitates meaningful social interactions and activities, impacting over 800 residents. The website is built on WordPress with modern plugins and SEO tools, hosted by Hostnet B.V., and employs HTTPS with DNSSEC for security. While the site demonstrates good content quality, mobile optimization, and basic privacy compliance, explicit security policies and incident response information are absent. Overall, the site reflects a trustworthy and community-focused organization with room for enhanced security transparency.

J

Joint Projects

toegankelijkerecreatie.nl

60

Joint Projects operates a specialized community platform focused on accessible recreation in the Netherlands, connecting a diverse set of stakeholders including entrepreneurs, designers, manufacturers, and government bodies. The platform serves as a knowledge hub and networking space to promote inclusivity in recreation. The business is well positioned as a niche leader with recognized memberships in industry associations such as TEA and IAAPA. The website content is professional and targeted to a clearly defined audience, supporting the organization's mission. Technically, the website is built on WordPress using modern plugins and frameworks, including WooCommerce and Ultimate Member, with integration of Google Tag Manager and reCAPTCHA for analytics and security. The site demonstrates good mobile optimization, accessibility, and SEO practices, though there is room for improvement in security headers and cookie consent mechanisms. From a security perspective, the site uses HTTPS and implements reCAPTCHA, but lacks explicit security headers and a formal security policy or incident response contact. No vulnerabilities or exposed sensitive data were detected. The domain is well aged and consistent with the business claims, enhancing trustworthiness. Overall, the website presents a low-risk profile with good business credibility and technical maturity. Strategic improvements in security headers, cookie consent, and formal security policies would further strengthen the security posture and compliance standing.

S

Stichting het Gehandicapte Kind

nsgk.nl

47

Stichting het Gehandicapte Kind is a well-established Dutch non-profit organization dedicated to supporting children with disabilities by promoting inclusion in education, play, and sports. The website effectively communicates its mission, projects, and ways to support through donations and volunteering, targeting donors, families, and the general public. The organization holds recognized certifications such as ANBI and CBF, enhancing its credibility. Technically, the site is built on Drupal 9 with modern tracking and consent management tools, ensuring a good digital maturity level. Security posture is solid with HTTPS, reCAPTCHA, and cookie consent, though some security headers and policies could be improved. Overall, the site is professional, trustworthy, and compliant with privacy regulations.

S

Stichting Reclame Code

reclamecode.nl

65

Stichting Reclame Code is a Dutch non-profit organization responsible for applying and enforcing the Dutch Advertising Code. The website serves as a platform for consumers, advertisers, and influencers to file complaints, access rulings, and obtain training and advice related to advertising compliance. The organization holds a strong market position as the primary authority on advertising standards in the Netherlands, with clear affiliations to European self-regulatory bodies. Technically, the website is built on the Umbraco CMS platform, leveraging modern web technologies such as Bootstrap and Google Tag Manager. The site is well-structured, mobile-optimized, and provides a good user experience with clear navigation and relevant content. Security-wise, the site uses HTTPS and secure forms but lacks visible security headers and explicit incident response or security policies. Privacy compliance is partially addressed with a privacy policy but lacks a cookie consent mechanism. Overall, the website is professional, trustworthy, and serves its regulatory purpose effectively.

M

mySociety

mysociety.org

63

mySociety is a UK-based not-for-profit social enterprise focused on empowering citizens through digital technologies in the areas of democracy, transparency, and community engagement. With over 20 years of experience and a presence in more than 40 countries, it operates a suite of popular civic technology services and provides commercial services through its subsidiary SocietyWorks to fund its charitable mission. The website reflects a mature organization with a clear mission and strong market position in the civic tech sector. Technically, the website is built on WordPress with modern web technologies including jQuery, Google Analytics with IP anonymization, and social media integrations. The site is well-structured, mobile-optimized, and SEO-friendly, though performance is moderate. Security posture is good with HTTPS enforced and no visible vulnerabilities, but could be improved by adding security headers and explicit cookie consent mechanisms. Security-wise, the organization demonstrates good practices such as anonymizing analytics data and avoiding exposed sensitive information. However, the lack of visible security policies, incident response contacts, and vulnerability disclosure mechanisms suggests room for improvement in transparency and readiness. The absence of WHOIS data limits domain trust verification but is mitigated by strong business signals on the site. Overall, mySociety presents a trustworthy, professional, and well-maintained online presence with minor gaps in privacy compliance and security transparency. Strategic improvements in cookie consent, security headers, and incident response visibility would enhance its security posture and user trust.

S

ShelterBox

shelterbox.org

68

ShelterBox is a well-established UK-based non-profit organization specializing in providing emergency shelter and disaster relief to families affected by conflict and natural disasters worldwide. With a domain age dating back to 2001 and a network of international affiliates, ShelterBox holds a strong market position in the humanitarian aid sector. Their website is professionally designed, content-rich, and targets donors, volunteers, and affected communities effectively. Technically, the site is built on WordPress, leveraging modern analytics and tracking tools such as Google Analytics, Facebook Pixel, and Hotjar, with Cloudflare providing DNS and CDN services. Security posture is solid with HTTPS enforced, though there is room for improvement in security headers and explicit incident response documentation. Privacy compliance is well addressed with comprehensive privacy and cookie policies, and GDPR adherence is evident. Overall, the website demonstrates high professionalism, trustworthiness, and operational maturity.

I

International Committee of the Red Cross

icrc.org

70

The International Committee of the Red Cross (ICRC) is a globally recognized humanitarian organization dedicated to providing assistance and protection to people affected by armed conflict and violence. The website reflects the organization's mission of neutrality, impartiality, and independence, offering extensive information on their activities, global presence, and urgent appeals for donations. The site is multilingual and professionally designed, targeting a broad audience including donors, affected populations, and humanitarian partners. Technically, the website is built on Drupal 10, employs modern security and privacy technologies such as hCaptcha and Usercentrics CMP, and integrates Google Tag Manager for analytics. Security posture is strong with HTTPS enforced and secure form handling, though explicit security headers and a public security policy are absent. Overall, the website is trustworthy, compliant with GDPR, and provides a safe user experience.

A

Access Info Europe

access-info.org

50

Access Info Europe is a non-profit organization dedicated to promoting the right to information and transparency. The website serves as a platform for advocacy, public interest campaigns, and legal research related to access to information. The organization targets civil society, transparency advocates, and the general public. The website is built on WordPress using the Avada theme and WPML for multilingual support, indicating a mature digital infrastructure. Google Analytics and Tag Manager are employed for visitor tracking, reflecting a moderate level of digital maturity. Security posture is adequate with HTTPS enabled, but lacks advanced security headers and explicit privacy or cookie policies, which are areas for improvement. Overall, the website is professional and trustworthy, with content relevant to its mission and audience.

G

Geldersch Landschap en Kasteelen

glk.nl

72

Geldersch Landschap en Kasteelen (GLK) is a well-established Dutch non-profit organization founded in 1929, dedicated to the conservation and management of nature areas, castles, and estates in the Gelderland region. The organization offers public engagement through excursions, activities, and donor programs, positioning itself as a trusted steward of cultural and natural heritage. The website reflects a mature digital presence with professional design, clear navigation, and comprehensive content tailored to nature enthusiasts and local communities. Technically, the site leverages modern web technologies including WordPress CMS, imgix for image delivery, and Google Tag Manager for analytics, ensuring good performance and mobile optimization. Security posture is strong with HTTPS enforcement and standard security headers, though there is room for improvement in publishing explicit security policies and incident response information. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, GLK's website demonstrates high trustworthiness, professionalism, and alignment with its mission and audience.

A

Asociatia Fumatorilor

asociatiafumatorilor.ro

49

Asociatia Fumatorilor is a Romanian non-profit organization advocating for smokers' rights and lifestyle freedom. It operates a community and private club network called Clubul Fumatorilor™, promoting equal access for smokers and non-smokers. The website serves as an information hub and community platform with content in Romanian and some English linkage. Technically, the site is built on Drupal CMS with common web technologies and includes Google Analytics and Google Adsense for tracking and monetization. Security posture is moderate with HTTPS enabled and IP anonymization in analytics, but lacks explicit security headers and privacy policy documentation. The domain WHOIS data is privacy protected by ROTLD, which is typical for Romanian domains, and no registrant details are publicly disclosed. Overall, the site is functional and moderately professional but could improve in privacy compliance and security best practices.

N

NATIONAL ENDOWMENT FOR DEMOCRACY

ned.org

70

The National Endowment for Democracy (NED) operates as a large, well-established non-profit organization dedicated to supporting democratic institutions worldwide through grantmaking, fellowships, research, and events. The website reflects a professional and comprehensive digital presence, targeting NGOs, democracy advocates, and the general public interested in democracy promotion. Technically, the site is built on WordPress with a modern tech stack including jQuery, Google Analytics, and New Relic monitoring, delivering moderate performance and good mobile optimization. Security posture is solid with HTTPS, security headers, and monitoring tools, though incident response and vulnerability disclosure mechanisms are not explicitly visible. Overall, the site is trustworthy, well-branded, and compliant with privacy regulations, though WHOIS data is unavailable, likely due to privacy protection common in non-profits.

C

Center za informiranje, sodelovanje in razvoj nevladnih organizacij (CNVOS)

cnvos.si

54

CNVOS is a well-established Slovenian non-profit umbrella organization supporting over 1600 NGOs through advocacy, legal advice, training, and sector promotion. The website reflects a mature digital presence with clear navigation, professional design, and relevant content tailored to the NGO sector. Technically, the site uses modern frameworks like Bootstrap and integrates privacy-conscious analytics (Plausible). Security posture is solid with HTTPS and secure form handling, though improvements in security headers and published policies are recommended. Overall, CNVOS demonstrates strong business credibility and sector leadership with a trustworthy online presence.

D

Danes je nov dan - Inštitut za druga vprašanja

danesjenovdan.si

58

Danes je nov dan is a Slovenian non-profit institute focused on advancing digital rights, democratic participation, transparency, and community solidarity. Established in 2012, it operates through advocacy, research, public engagement, and publication of a monthly newsletter. The organization maintains a strong online presence with active social media channels and collaborative projects with recognized partners such as EDRi and Pravno mrežo za varstvo demokracije. The website reflects a professional and consistent brand image with excellent content quality and user experience. Technically, the website employs modern JavaScript libraries including Alpine.js and htmx, and uses Plausible Analytics for privacy-respecting user tracking. The site is hosted by a Slovenian registrar HITROST.COM and demonstrates fast performance and excellent mobile optimization. However, there is room for improvement in security headers and explicit cookie consent mechanisms. From a security perspective, the site uses HTTPS and secure forms with consent checkboxes, but lacks published security policies and incident response contacts. No vulnerabilities or exposed sensitive data were detected. Overall, the security posture is good but could be enhanced by adopting additional best practices. The overall risk assessment is low, with the site being trustworthy and professionally maintained. Strategic recommendations include implementing cookie consent banners, publishing security and incident response policies, and adding vulnerability disclosure information to further strengthen trust and compliance.

D

Danes je nov dan - Inštitut za druga vprašanja

djnd.si

58

Danes je nov dan is a Slovenian non-profit institute focused on digital rights, democratic participation, transparency, and community solidarity. Established in 2012, it operates various advocacy and awareness projects, publishes a monthly newsletter, and maintains an active presence in media and social platforms. The organization targets Slovenian-speaking audiences interested in digital and democratic issues. Technically, the website uses modern JavaScript libraries such as Alpine.js and htmx, with privacy-respecting analytics via Plausible. The site is well-designed, mobile-optimized, and provides clear navigation and rich content. Security posture is good with HTTPS enforced and no visible vulnerabilities, though it lacks some security headers and explicit security policies. Privacy compliance is mostly good, with a clear privacy policy but missing cookie consent mechanisms. Overall, the website is professional, trustworthy, and reflects an active, credible non-profit entity.

S

Smokers Association

smokersassociation.org

53

Smokers Association is a small non-profit organization advocating for the rights and freedoms of smokers worldwide. The website serves as a community hub offering articles, media, and event information related to smokers' rights and lifestyle choices. It positions itself as a defender of personal liberty against segregation and restrictive policies. The site has been active since at least 2008, with content reflecting ongoing advocacy and community engagement. Technically, the website is built on Drupal CMS with common web technologies such as jQuery and integrates Google Analytics and Adsense for tracking and monetization. The site is mobile-friendly and moderately optimized but lacks advanced SEO and accessibility features. Security posture is adequate with HTTPS enabled but lacks important security headers and formal security policies. The absence of WHOIS data and registrant information reduces domain trustworthiness, although the website content and historical presence suggest legitimacy. Privacy compliance is minimal, with no privacy or terms of service pages found, but a cookie consent mechanism is implemented. Contact is only available via a web form, with no direct emails or phone numbers provided. Overall, the site is functional and serves its advocacy purpose but would benefit from improved transparency, security practices, and privacy compliance to enhance trust and professionalism.

Bénévalibre is a French non-profit initiative providing free open-source software to assist very small associations in managing and valorizing volunteer work. The project is supported by CRAJEP Bourgogne-Franche-Comté and several financial and expert partners. The website serves as an informational portal and access point to the web application. Technically, the site is built on WordPress with standard plugins and modern web technologies, offering a moderate performance and good mobile optimization. Security posture is adequate with HTTPS enabled and domain transfer protection, but lacks DNSSEC and security headers. Privacy compliance is limited due to absence of cookie consent and detailed GDPR policies. Overall, the domain registration and website content align well, indicating a legitimate and focused non-profit project.

S

Specialdelivery

specialdeliverysandiego.org

57

Special Delivery San Diego is a small non-profit organization dedicated to providing nutritional support to the San Diego community through home-delivered meals, a nutrition pantry, and diabetic education programs. The organization relies on donations and volunteer efforts to serve over 800 families monthly. The website is built on the Wix platform, featuring a professional design with clear navigation and calls to action for volunteering and donations. Technically, the site uses modern web technologies and enforces HTTPS, but lacks advanced security headers and privacy compliance features. No WHOIS data was available due to query failure or privacy protection, but the domain and website content appear consistent with a legitimate non-profit entity. Overall, the site demonstrates good business credibility and content quality but should improve privacy policies and security practices to enhance trust and compliance.

Southern California Bulldog Rescue is a small non-profit organization dedicated to rescuing and rehoming bulldogs in the Southern California region. The website serves as an informational platform to support their mission, targeting animal lovers, potential adopters, and donors. The organization has a long-standing presence since 2006, reflected in the domain registration data. Technically, the website is built on the Snap Cloud CMS platform, hosted on AWS infrastructure, and uses common web technologies such as JavaScript and Google Fonts. The site is accessible and uses HTTPS, but lacks advanced security headers and privacy compliance features. There is minimal content and no visible contact or policy pages, which limits user engagement and trust signals. Security posture is moderate with room for improvement in headers and policy disclosures. Overall, the website is functional but basic, with recommendations to enhance security, privacy compliance, and user trust.

W

Womanity

womanity.org

56

The Womanity Foundation is a Swiss-based non-profit organization dedicated to accelerating gender equality through innovative programs focused on education, land rights, media, and violence prevention. The organization has a strong market position, recognized globally for its impact and sustainability, with over 31 million people supported since 2005. The website reflects a mature digital presence with multilingual support, secure donation processing, and active social media engagement. Technically, the site is built on WordPress with modern plugins and integrations, offering good performance and accessibility. Security posture is solid with HTTPS, secure payment gateways, and anti-bot measures, though improvements like DNSSEC and enhanced security headers are recommended. Privacy compliance is well addressed with clear policies and consent mechanisms. Overall, the site projects high professionalism and trustworthiness, supporting the organization's mission effectively.

I

IVN Nederland

ivn.nl

48

IVN Nederland is a well-established Dutch non-profit organization dedicated to nature education and engagement for children and adults. The organization offers a wide range of services including nature activities, courses, volunteer programs, and a nature routes app. IVN holds recognized certifications such as ANBI and CBF, reinforcing its credibility and trustworthiness in the non-profit sector. The website is professionally designed with excellent content quality, clear navigation, and strong branding consistency, targeting a broad audience interested in nature and environmental education. Technically, the website is built on WordPress with modern technologies including jQuery, Google Maps API, and various marketing and analytics tools like Google Tag Manager, Hotjar, and Microsoft Clarity. The site demonstrates good mobile optimization, accessibility, and SEO practices. Security posture is solid with HTTPS enforced and no visible vulnerabilities, though some security headers could be improved. Privacy compliance is strong with comprehensive privacy and cookie policies and active consent mechanisms. Overall, IVN Nederland's digital presence reflects a mature and trustworthy organization with a clear mission and effective online engagement. The absence of critical security issues and the presence of multiple trust indicators support a high level of business credibility and user trust.

C

Civic Science Fellows

civicsciencefellows.org

47

Civic Science Fellows is a US-based non-profit organization focused on fostering leadership and collaboration between science and society through its fellowship program. The website presents a professional and well-structured platform built on WordPress, hosted on DigitalOcean, with a clear focus on community engagement and educational content. The technical infrastructure is modern and mobile-optimized, though performance is moderate. Security posture is adequate with HTTPS enabled and domain transfer protections, but lacks DNSSEC and security headers, which are recommended for enhanced protection. Privacy compliance is weak due to the absence of privacy and cookie policies, and no GDPR indicators are present. Contact information is limited to a contact form and newsletter signup, with no direct emails or phone numbers provided. Overall, the site is trustworthy and safe for general audiences but would benefit from improved privacy and security practices.

T

The Signals Network

thesignalsnetwork.org

66

The Signals Network is a small non-profit organization dedicated to supporting whistleblowers and coordinating international media investigations focused on corporate misconduct and human rights abuses. The organization positions itself as a trusted intermediary for whistleblowers and media, emphasizing accountability and public good. The website reflects this mission with professional design and relevant content targeting whistleblowers, journalists, and the public. Technically, the website is built on WordPress using the Avada theme, hosted on DigitalOcean, and employs modern performance optimizations such as WP Rocket and lazy loading. It integrates several marketing and analytics tools including Google Analytics, Google Tag Manager, and LinkedIn Insight Tag. Mobile optimization and SEO practices are good, though accessibility is basic. From a security perspective, the site uses HTTPS with a good SSL configuration and enforces client transfer protection on the domain. However, DNSSEC is not enabled and security headers are minimal or absent. There is no visible security policy or vulnerability disclosure mechanism, and no explicit incident response contacts. Cookie consent is implemented via Termly with auto-blocking, indicating some privacy compliance effort. Overall, the website is trustworthy and professional with a solid business credibility score. Security posture is moderate with room for improvement in headers and disclosure policies. Privacy compliance is basic due to missing explicit privacy and terms pages. Recommendations include enabling DNSSEC, adding security headers, publishing security and privacy policies, and providing direct contact channels for security incidents.

F

Fundacja Panoptykon

panoptykon.org

41

Fundacja Panoptykon is a Polish non-profit organization dedicated to human rights and digital privacy advocacy. Established in 2009, it operates primarily in Poland and provides a range of services including publications, campaigns, legal complaints, and public awareness initiatives. The website serves as a platform for disseminating information and engaging the public on issues related to surveillance, privacy, and freedom in the digital age. The organization maintains a strong presence through various content types such as articles, reports, podcasts, and videos, targeting a general audience interested in digital rights and privacy.

C

Civil Liberties Union for Europe

liberties.eu

11

The Civil Liberties Union for Europe operates as a non-profit human rights watchdog focused on protecting and promoting civil liberties across the European Union. The organization provides advocacy, campaigns, training, and research services to inform and mobilize citizens and civil society organizations. Their market position is strong within the EU human rights sector, supported by a network of NGOs and media presence. Technically, the website is built on a modern Ruby on Rails stack with CDN and security integrations such as reCAPTCHA and Stripe for donations. The site is well-optimized for performance, mobile, and accessibility. Security posture is robust with HTTPS, security headers, and CSRF protections, though explicit security policies and incident response details are not published. Overall, the website is professional, trustworthy, and compliant with GDPR and cookie regulations, with no signs of malicious activity or content blocking.

I

Irish Council for Civil Liberties

iccl.ie

10

The Irish Council for Civil Liberties (ICCL) is Ireland's oldest human rights organization, established in 1976. It operates as a non-profit advocacy group focused on promoting and protecting human rights across various sectors including justice, equality, digital rights, and democratic freedoms. The organization is independent and non-partisan, funded primarily through members and donors. The website serves as a platform for news, campaigns, petitions, and educational resources aimed at the general public interested in human rights issues in Ireland. Technically, the website is built on WordPress with modern SEO and analytics tools such as Yoast SEO and Matomo Analytics. It uses HTTPS and includes responsive design elements for mobile optimization. The site demonstrates good performance and accessibility basics, though there is room for improvement in security headers and cookie consent mechanisms. From a security perspective, the site employs HTTPS and disables cookies in analytics to enhance privacy. However, it lacks explicit security policies, incident response contacts, and vulnerability disclosure mechanisms. No critical vulnerabilities or exposed sensitive data were detected in the content. The absence of WHOIS data limits domain trust verification, but the website content and contact information align with a legitimate non-profit entity. Overall, the website presents a professional and trustworthy front for ICCL, with strong content quality and business credibility. Strategic recommendations include enhancing security headers, implementing cookie consent, publishing security and incident response policies, and establishing a vulnerability disclosure process to further strengthen trust and compliance.

G

Gong

gong.hr

10

Gong is a well-established Croatian non-profit organization founded in 1997, dedicated to promoting active citizen participation in political processes. The organization offers educational programs, research, and digital tools aimed at enhancing democracy, transparency, and civic engagement. Their market position is strong within the Croatian civil society sector, supported by partnerships with governmental and EU bodies. The website reflects a professional and consistent brand image with clear communication channels and comprehensive content relevant to their mission. Technically, the site is built on WordPress with modern plugins and frameworks, offering good mobile optimization and SEO practices. Security posture is solid with HTTPS and cookie consent mechanisms, though some improvements in security headers and incident response disclosures are recommended. Overall, the site is safe, trustworthy, and compliant with GDPR requirements.

N

Nederlandse Vereniging Beheer keurmerk Aangepaste Vakanties

nbav.nl

53

The website www.nbav.nl represents the Nederlandse Vereniging Beheer keurmerk Aangepaste Vakanties, a Dutch organization providing certification for entities focused on people with disabilities. The site is built on the Wix platform, utilizing Wix's Thunderbolt framework and standard JavaScript polyfills. The content is primarily in Dutch and targets organizations and stakeholders in the disability support sector. The business model revolves around certification and association management within a niche market in the Netherlands. Technical infrastructure is standard for Wix-hosted sites, with moderate performance and good mobile optimization but limited SEO due to meta robots noindex directive. Security posture is basic, lacking advanced security headers and policies, and no privacy or cookie policies are present, indicating compliance gaps. Overall, the site is functional but would benefit from enhanced security and privacy measures to improve trust and compliance.

L

Libre Association (groupe de travail de l’April)

libreassociation.info

52

Libre Association is a small non-profit working group under the April organization, dedicated to bridging the associative sector and free software. The website provides educational content, community resources, and practical guides to promote free software usage among associations, primarily targeting French-speaking users. The site is professionally designed with consistent branding and clear navigation, leveraging SPIP CMS and Bootstrap frameworks. It uses Matomo analytics configured with privacy considerations, reflecting a moderate digital maturity. Security posture is adequate with HTTPS usage implied, but lacks explicit security headers and published privacy or cookie policies, which are areas for improvement. No contact information or incident response channels are provided, limiting transparency. Overall, the website is trustworthy and safe, with no adult or questionable content detected.

T

Take Back The Tech!

takebackthetech.net

38

Take Back The Tech! is a well-established non-profit campaign founded in 2006, dedicated to empowering women and girls to take control of technology to end gender-based violence. The website serves as an educational and advocacy platform offering resources, campaigns, and community engagement tools. It targets activists, women, and communities concerned with technology-facilitated violence. Technically, the site is built on Drupal 9 with modern web technologies, providing a responsive and accessible user experience. However, some technical aspects such as DNSSEC and security headers could be improved to enhance security. The security posture is moderate with domain management practices that prevent unauthorized changes but lacks published security policies or incident response information. Privacy compliance is basic, with a privacy policy present but no cookie consent mechanism detected. Overall, the website is credible and trustworthy, with a clear mission and consistent branding, but could benefit from enhanced security and privacy practices.

L

Les métiers en Église

metiers-eglise.ch

9

Les métiers en Église is a small-scale informational website focused on presenting various vocations and professions within the Catholic Church, primarily targeting a general audience interested in religious careers. The website is built on the Wix platform, leveraging Wix's hosting and content management capabilities, with a moderate level of technical maturity. It uses HTTPS and standard Wix scripts but lacks advanced security headers and privacy compliance mechanisms. The site includes Google Tag Manager for analytics but does not provide visible privacy or cookie policies, nor contact information for users or security incidents. Overall, the website is professionally designed with good content relevance but requires improvements in privacy compliance and security best practices to enhance trust and regulatory adherence.

R

Radically Open Security

radicallyopensecurity.com

70

Radically Open Security is a non-profit computer security consultancy focused on improving global security through research, networking, and forensics expertise. The organization targets clients seeking expert security consultancy and is staffed by security researchers and Capture The Flag winners, positioning itself as a niche player in the non-profit security sector. The website presents a professional and consistent brand image with good content quality and clear messaging about its mission and services. Technically, the site uses modern web standards with HTTPS and a Content Security Policy, but lacks advanced security headers and privacy compliance documentation. The absence of WHOIS registration data raises some concerns about domain legitimacy, though the website content suggests a genuine organization. Overall, the site demonstrates a solid security posture but would benefit from enhanced privacy policies and contact transparency.

C

Center for the Cultivation of Technology gGmbH

techcultivation.org

49

The Center for the Cultivation of Technology is a small non-profit organization based in Germany that provides fiscal sponsorship and backend organizational support for international Free Software and open source projects. Their services include donation processing, budget management, asset stewardship, and expert knowledge sharing, enabling developers to focus on software development while the Center handles administrative and financial tasks. The website clearly communicates their mission and services, targeting open source projects and developers seeking a legal and financial host. Technically, the website is built using the Hugo static site generator with Bootstrap 3, jQuery, and Font Awesome for styling and interactivity. The site is mobile-optimized and presents a professional design with clear navigation. However, some technical aspects such as DNSSEC are not enabled, and no advanced security headers were detected. The site does not appear to use analytics or tracking scripts, indicating a privacy-conscious approach. From a security perspective, the website uses HTTPS and has domain transfer protections in place, but lacks published privacy and cookie policies, security policies, and incident response information. No direct contact emails or phone numbers are provided, only contact forms. These gaps reduce privacy compliance and security transparency. No suspicious or malicious content was detected, and the domain registration data is consistent with the organization's claims. Overall, the website is trustworthy and professional but would benefit from improved privacy compliance, enhanced security headers, and more transparent contact and security policy information to strengthen user trust and regulatory adherence.

C

Cazadores de Fake News

cazadoresdefakenews.info

55

Cazadores de Fake News is a Venezuelan non-governmental organization dedicated to monitoring and combating misinformation spread through social networks and instant messaging in Venezuela and Latin America. The website serves as a platform for publishing fact-check articles, educational resources, and offers a chatbot verification service via WhatsApp. The organization targets the general public concerned with misinformation and disinformation in the region. Technically, the website is built on WordPress using modern themes and plugins, with good mobile optimization and SEO practices. Security posture is adequate with HTTPS enabled, but lacks some security headers and cookie consent mechanisms. The WHOIS data is malformed and unavailable, which limits domain trust verification, but the website content and social media presence support its legitimacy. Overall, the site is professional, content-rich, and trustworthy, with room for improvement in security headers and privacy compliance.

A

AFAS Foundation

afas.foundation

65

The AFAS Foundation is a Dutch non-profit organization dedicated to inspiring and supporting social projects that create significant positive impact. The foundation focuses on funding and facilitating initiatives that help many people and inspire change. Their website is professionally designed, mobile-optimized, and provides detailed information about ongoing projects, events, and news updates. Technically, the site uses modern web technologies including Bootstrap, Font Awesome, and Google Tag Manager for analytics. Security posture is moderate with HTTPS implied but lacks explicit security headers and privacy policies. The absence of WHOIS data limits full verification of domain legitimacy, but the website content and branding are consistent with a reputable non-profit entity. Overall, the foundation demonstrates a solid digital presence with room for improvement in privacy compliance and security best practices.

V

Villars-Animation

vsg-animation.ch

49

Villars-Animation is a local socio-cultural animation service operating under the commune of Villars-sur-Glâne, Switzerland. It focuses on providing activities and community support primarily for youth aged 6 to 25, as well as families, elderly, and migrants. The organization offers a variety of creative, cultural, and sports activities across multiple centers and locations. The website serves as an informational portal for these services and upcoming events. Technically, the website is built on Drupal 7 with a moderate technology stack including jQuery 1.12 and Matomo analytics. While the site is functional and provides good content quality and navigation, it lacks modern security headers and uses outdated JavaScript libraries, which could pose security risks. The site is accessible via HTTPS, but no explicit security policies or privacy notices are present. From a security perspective, the site shows moderate maturity with no visible critical vulnerabilities but lacks important compliance elements such as privacy and cookie policies, GDPR indicators, and incident response contacts. The use of Matomo analytics without a visible cookie consent mechanism suggests potential privacy compliance gaps. No WAF or blocking mechanisms were detected, and the content is safe for general audiences. Overall, the website is a trustworthy local community service platform but would benefit from enhanced security practices, privacy compliance improvements, and clearer contact information to improve user trust and regulatory adherence.

A

Acorn Active Media Foundation

thexlab.org

50

The XLab is a US-based non-profit research institution focused on advancing digital equity through broadband mapping, affordability research, community networking, and digital privacy advocacy. The organization serves a diverse audience including policymakers, community leaders, researchers, and local ISPs. Their market position is that of a pioneer and leader in broadband and digital equity initiatives, with a strong emphasis on open source and open data principles. Technically, the website is built on WordPress with Elementor and Astra theme, leveraging modern web technologies and providing a good user experience with mobile optimization. Security posture is adequate with HTTPS enabled and domain transfer protection, but lacks advanced security headers and published security policies. Privacy compliance is weak due to absence of privacy and cookie policies. Overall, the website is professional and trustworthy, but could improve in compliance and security transparency.

A

Anthropocene Magazine

anthropocenemagazine.org

55

Anthropocene Magazine is a nonprofit journalism platform dedicated to exploring sustainability, environmental science, and climate change solutions. It targets researchers, policymakers, designers, educators, and the general public interested in creating a sustainable Human Age. The website offers rich content including articles, newsletters, print editions, and live storytelling events. The business model relies on donations and memberships, positioning itself as a niche leader in environmental media. Technically, the site is built on WordPress with the Divi theme, uses Google Fonts, and integrates Google Analytics with opt-out capabilities. The site is mobile-optimized and SEO-friendly, though accessibility features are basic. Security posture is good with HTTPS enforced, but lacks some security headers and explicit security policies. Privacy compliance is limited due to missing privacy and cookie policies. Overall, the site is professional, trustworthy, and content-rich, but could improve in privacy transparency and security best practices.

The Courage Foundation is an established international non-profit organization founded in 2013, dedicated to supporting whistleblowers and journalists who face persecution. The website serves as a platform for advocacy, fundraising, and public awareness campaigns, particularly focusing on high-profile cases such as Julian Assange. The organization targets activists, supporters of press freedom, and the general public interested in human rights. Technically, the site is built on WordPress with common plugins for contact forms and donations, showing moderate performance and good mobile optimization. Security posture is adequate with HTTPS enabled but lacks advanced security headers and DNSSEC, and no formal privacy or cookie policies are published. Contact information is limited but includes verified email addresses and social media links. Overall, the site is professional, trustworthy, and content is safe for general audiences.

O

OrpheusPDX

orpheuspdx.org

58

OrpheusPDX is a small non-profit opera company based in Portland, Oregon, focused on delivering intimate opera performances and engaging the local community. The organization offers seasonal opera productions, subscription services, and opportunities for donations and volunteering. Their market position is that of a niche performing arts entity serving opera enthusiasts and the Portland arts community. Technically, the website is built on WordPress with a modern tech stack including jQuery, Select2, and Google Analytics integrations. The site is mobile optimized and provides a good user experience with clear navigation and professional design. Security posture is adequate with HTTPS enforced and domain transfer protections in place, but lacks DNSSEC and security headers. Privacy compliance is basic, with a privacy policy present but no cookie consent mechanism or GDPR indicators. Overall, the website is trustworthy and professionally maintained, though improvements in security and privacy compliance are recommended.

F

freieFarbe e.V.

freiefarbe.de

50

freieFarbe e.V. is a small non-profit organization based in Germany dedicated to promoting color communication and freeing color from constraints. The website serves as an educational platform targeting professionals and enthusiasts interested in color standards and communication. It offers resources and advocacy services related to color communication. Technically, the website is built on WordPress with a modern plugin ecosystem including Real Cookie Banner for GDPR-compliant consent management, and uses reputable third-party services such as Google Fonts, YouTube, and Vimeo. The site is hosted on kasserver.com and employs HTTPS with good security headers, indicating a solid security posture. However, no explicit security policy or incident response information is published, which could be improved. Privacy compliance is strong with a comprehensive privacy policy and cookie consent mechanism. Overall, the website is professional, trustworthy, and safe for general audiences.

B

Ben Stocker Johnson

bensjohnson.com

41

Ben Stocker Johnson is a seasoned art director, designer, and illustrator specializing in visual storytelling for social good. The website serves as a professional portfolio showcasing a broad range of creative services including art direction, user experience, brand identity, illustration, and print design. The target audience primarily consists of mission-driven organizations such as nonprofits, government agencies, and social innovators. The business model is consultancy and creative services with a strong emphasis on cause-based projects. The website reflects over 20 years of experience, consistent with the domain age dating back to 2000. Technically, the website employs standard web technologies including HTML5, CSS3, JavaScript, jQuery, and Font Awesome icons. It integrates Google Analytics and Google Tag Manager for tracking and analytics. Hosting appears to be managed via Google Cloud DNS with domain registration through Squarespace Domains II LLC. The site is moderately optimized for performance and mobile devices, with good SEO practices but basic accessibility features. From a security perspective, the site uses domain status flags to prevent unauthorized domain transfer or deletion but lacks DNSSEC and visible security headers. There is no privacy or cookie policy present, which impacts compliance with GDPR and other privacy regulations. No incident response or vulnerability disclosure information is published. The site does not appear to be behind a WAF or security challenge, and no malicious or suspicious content is detected. Overall, the website is professional, trustworthy, and well-aligned with its business purpose. However, it would benefit from enhanced privacy compliance, improved security headers, and explicit policies to strengthen its security posture and regulatory adherence.

F

Floatleft

floatleft.org

64

Floatleft is a specialized nonprofit website development company focusing on Drupal and WordPress platforms. Established in 2004, it serves nonprofit organizations primarily in the United States, offering tailored web development services to meet the unique needs of the nonprofit sector. The company positions itself as a niche provider with expertise in nonprofit digital presence and SEO optimization, leveraging tools like Yoast SEO and Google Analytics to enhance client websites. Technically, the website is built on WordPress, hosted on Pantheon, and uses Cloudflare DNS services. The site demonstrates moderate performance and good mobile optimization, though accessibility features are basic. Security-wise, the site uses HTTPS with domain status protections but lacks DNSSEC and security headers, indicating room for improvement in domain and web security practices. Privacy compliance is weak, with no visible privacy or cookie policies and no GDPR compliance indicators. Contact information is not explicitly provided, which may affect user trust and compliance. Overall, the website is professional and safe, but enhancements in privacy, security policies, and contact transparency are recommended.

C

CommitChange LLC

commitchange.com

62

CommitChange LLC operates an all-in-one fundraising platform tailored for nonprofit organizations and social impact movements. The platform offers donation processing, fundraising campaigns, supporter management, event ticketing, and reporting tools, positioning itself as an accessible and intuitive solution for nonprofits to efficiently manage their fundraising efforts. The business model is SaaS-based with no monthly fees or contracts, appealing to organizations seeking flexible and cost-effective fundraising software. The company has been established since 2012, indicating a mature presence in the nonprofit technology sector. Technically, the website is built on WordPress 6.6.2 with jQuery and uses the Fluent Forms plugin for data collection. Hosting and DNS services leverage Cloudflare, providing a reliable infrastructure. The site demonstrates good mobile optimization and SEO practices but lacks advanced security headers and DNSSEC, which are areas for improvement. The website content is professionally designed with clear navigation and relevant information for its target audience. From a security perspective, the site uses HTTPS and has domain transfer protections enabled, but it lacks DNSSEC and security headers such as Content-Security-Policy and Strict-Transport-Security. No explicit security policies or incident response contacts are published, which could be a gap in transparency and readiness. The absence of cookie consent mechanisms may also impact privacy compliance, especially under GDPR. Overall, the security posture is moderate but could be enhanced with additional controls and disclosures. The overall risk assessment is low to moderate. The website is trustworthy and professional, serving a clear nonprofit market niche. Strategic recommendations include enabling DNSSEC, implementing security headers, publishing security and incident response policies, and adding cookie consent mechanisms to improve compliance and user trust. These steps will strengthen the platform's security posture and regulatory adherence, supporting its growth and reputation in the nonprofit sector.