I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of value they are trying to protect is user real name and email address. But, they are considered very sensitive and high value. No money is exchanged with users. Their activity history is not considered sensitive, just the fact they are associated with the site. There will be millions of users and high site visibility.

Thank You

  • 1
    You might want to be more specific about the kinds of nitty-gritty details you want to know about.
    – Joe Murray
    Commented Dec 9, 2015 at 16:24

2 Answers 2


CiviCRM is a good system if you want your data to remain secure. I would recommend installing on a hardened server following the normal instructions, and ensure you keep the security patches for your CMS and CiviCRM applied when they come out. Drupal, WordPress and Joomla! all have security announcement lists you can subscribe to. See https://civicrm.org/security for CiviCRM's.

During configuration you will want to ensure that the permissions are configured to prevent inappropriate access to data (eg see http://wp46.demo.civicrm.org/wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fadmin%2Faccess%2Fwp-permissions&reset=1 after logging with user demo password demo). For example, CiviCRM: view all contacts and CiviCRM: edit all contacts should be reserved to Administrative users, and CiviCRM: skip IDS check should be disabled for all users (IDS is Intrusion Detection System).


I think this is more a question on how to set up your configuration (which I am no expert on so I will not get into that) rather than programming in CiviCRM?

  • Both configuration and programming. Commented Dec 10, 2015 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.