Built to be trusted
Security and trust, shown not claimed
The money a charity raises deserves software that treats it carefully. Here is exactly how this platform protects the money, the data and the people who use it, and how it proves, on every build, that it keeps working.
24
automated self-tests
run against a real WordPress install
393
assertions
each one a promise the software keeps
90
prepared queries
every database read and write parameterised
119
permission checks
gating who is allowed to do what
The money
How the money is protected
Card details never reach us
A won lot becomes an ordinary WooCommerce order, settled by Stripe. Card numbers pass straight to Stripe’s PCI-certified checkout and never touch this platform or its database, so the sensitive part of a payment is never ours to lose.
Nothing taken in commission
The platform takes no percentage of anything raised. Every pound the room gives reaches the cause, and the totaliser counts every mechanic, so the number on the wall is the number the charity banks.
A bid can never be charged twice
Every bid carries an idempotency key. A phone that sends the same bid twice after a signal drop is still recorded once, and charged once. The self-tests assert this directly.
The people
How data and identity are protected
Signed, http-only identity
A bidder’s identity lives in a signed, http-only cookie the page cannot read or forge. The server never trusts a bidder id sent by the browser, only the signature it issued itself, so nobody can bid as someone else.
GDPR built in, not bolted on
A guest’s bids and watchlist export and erase through WordPress’s own privacy tools, and consent is captured at registration. A data request is a few clicks, not a manual database dig.
Every query parameterised
Ninety database reads and writes use prepared statements, so a name with an apostrophe or a hostile string in a form field is data, never a command. The door to SQL injection is closed.
Permission on every action
A hundred and nineteen capability checks gate who can do what, and every background request is nonce-protected against cross-site forgery. An organiser’s screen is not a guest’s, by construction.
Sealed lots stay sealed
A sealed bid never reveals its price, or even whether you are winning, until the lot closes. That privacy is asserted in the tests, because it is exactly the fact a sealed auction exists to keep.
Yours to own, not to rent
The platform runs on your own WordPress and your own Stripe. There is no third-party vault holding your donors’ data and no account that can be switched off underneath you.
Proven, not promised
The test suite
Twenty-four self-tests run against a real WordPress install and assert the things that would quietly lose a charity money if they broke. Three hundred and ninety-three assertions in all. A few of the promises they hold:
A core set of these now ships inside the platform and runs live against this very site, refreshed every day:
44 automated checks across 4 areas, all passing (last run 19 hours ago).Nobody sees another’s bids
One guest can never see another guest’s bidding history, and a sealed lot leaks neither its price nor whether you are winning. 30 assertions
The floor is counted right
Live floor bids land at the right amount, in the right order, and move the totaliser correctly. 33 assertions
A retracted bid is really gone
When a bid is retracted it stops counting everywhere at once, the price, the leader, the totaliser and the winner. 14 assertions
The winner’s email is the winner’s figure
The confirmation quotes the bidder’s own winning amount, never the lot’s last price or someone else’s. 16 assertions
Gift Aid maths is correct
The reclaim is calculated on eligible donations only, never on tickets, raffles or auction purchases HMRC does not allow. 12 assertions
The totaliser admits every mechanic
Lots, the paddle raise, the pop-up shop and votes all reach the total, so the wall figure is never quietly short. 17 assertions
Money survives an upgrade
Schema migrations carry an installed event’s data forward intact, so an update never loses a night’s giving. 10 assertions
Currency is handled to the penny
Amounts round, format and total correctly in the charity’s own currency, with no floating-point drift. 20 assertions
Pre-flight catches a bad setup
A pre-event check flags the misconfigurations that would spoil a night before the doors open, not after. 22 assertions
Every self-test creates its own data, asserts against it, and tidies up after itself, so the suite can be run against a live install without leaving a trace.
Software you can trust with the night
Book Kevin Durham as your charity auctioneer and this exact platform is built around your event, on your own WordPress and your own Stripe, with every safeguard on this page in place. It is included at no cost and stays live for a month after the night.