Receipting with password protected pdf's

Tara Henderson

In Canada we have to password protect our pdf receipts and keep a hard copy of them as well as have them stored to an offsite backup site. The Canadian Revenue Agenecy guidelines must be met. E-tapestry and Donor Perfect, less complex online cloud-based systems have this functionality through a third-party. Since e-Tapestry is a BB product I figured it would be available for RE clients too, but no luck on any helpful info so far from the case with support. 

How are other Canadian clients receipting donors with password protected e-receipts? 

What service is e-Tapestry using?!  https://www.kb.blackbaud.com/articles/Article/102479

Here are the guidelines for electronic tax receipting in Canada, according to CRA - https://www.canada.ca/en/revenue-agency/services/charities-giving/charities/operating-a-registered-charity/issuing-receipts/computer-generated-receipts.html


 

Brenda Heyer 2

Hi Tara,

Hopefully I am understanding your question.  E-receipts must be sent in an unalterable format- which is pdf. These do not need to be password protected. I've never received an electronic receipt where I need to open it with a password. 


The computer system where the pdf receipts are stored, this needs to be password protected.  When you send out a batch of pdf receipts, save them to the network drive appropriate and password protect the file.  Just make sure to document all this.  When you or whomever is asked to provide artifacts for audit, you'll need to be able to retrieve and print or show a copy of what was sent.  Receipt paper, likewise should be kept in a locked drawer.


Have I understood you correctly?

Brenda

Tara Henderson

Hi Brenda, the pdf's themselves must be encrypted, so they have to each have a unique password. DonorPerfect and eTapestry have implemented this for this year but not Raiser's Edge. I do not know how to do this. Hoping another org who is experiencing the same issue can help by sharing how they are doing it. 

CRA could site any charity not doing this as not meeting their requirements. I don't want to risk that. 

Tara

Brenda Heyer 2

Tara,

to confirm, you are saying the pdf you send a donor must be encrypted?

Tara Henderson

Hi Brenda, Yes. 

Brenda Heyer 2

Hi Tara,

I disagree.  I would phone charities directorate, as I have just done.  

The receipt needs to be sent in an unalterable format such as pdf.  The receipts stored on your server need to be protected.

Again, I've never received a receipt where I need to un-encrypt or use a password to open the receipt.

Brenda

 

Tara Henderson

Not sure if you can see the link from CRA in the original question, it says the doc itself must be encrypted. Will call the charities directorate.

Thanks,

Tara

Brenda Heyer 2

Tara,

It's the language.  Not the "doc" (receipt) you send to donors, the document that is created when you create your file of receipts.  In Raiser's Edge, this is created in a merged word document.  Once this has been created, save that file as a pdf on a secure server.  This must be protected.

Tara Henderson

I spoke with the Charities Directorate at CRA and they assured me pdf's that are not password protected are a legitimate way to receipt donors, we will not be in violation of the terms for electronic receipting. This may change over the next few years, as pay-stubs and other sensitive financial information sent to people's emails do need to be password protected. 

For donor privacy and to keep with the trend I hope to see this for Raiser's Edge receipts next year. Made a recommendation through my account manager. 

Thanks for talking it through with me, Brenda. 


Tara

Brenda Heyer 2

Hey Tara,

Glad the call solidified the information!


I would be interested to look into the password on a receipt further. Do you know of any other organizations that do this?   My only thoughts are, passwords may create confusion, will be forgotten, mis-typed and likely increase the call volume to a charity.  I have heard of emails with a link to a secure site for the donor to retrieve their receipt.  This sounds easier to me.


I regularly forgot my password for my pay-stub and therefore rarely looked at it! Not ideal.

Have a great day.

Brenda

Phillip Bicknell

[snip]

The receipt needs to be sent in an unalterable format such as pdf.  [snip]

 

A PDF file is not necessarily "unalterable". There are settings that can be applied when it is made to restrict editing privilege or afterwards using an Adobe product. So I would describe a PDF file as only being hard to alter.
https://en.wikipedia.org/wiki/Portable_Document_Format#Security_and_signatures
"Even without removing the password, most freeware or open source PDF readers ignore the permission "protections" and allow the user to print or make copy of excerpts of the text as if the document were not limited by password protection."

Etc


But the reason that regulators will be happy with a PDF file is that virtually nothing is impossible to fake, and in this instance what's being sent is a limited data-set for a single purpose from charity/non-profit to donor.

Pattie Roozendaal

Hi Tara,

We are also using e-Tapestry to create our Canadian Tax Receipts.  We are trying to do a batch job for 2018.  I can download the file with all the pdf's, but the auto-emailing feature doesn't seem to work.  For some unknown reason, the e-mails are not going to the donors.


Would you mind sharing your process for e-mailing the tax receipts through e-Tapestry?


Thanks very much,

Pattie Roozendaal

Avalanche Canada Foundation

foundation@avalanche.ca

Kim Wolcott

For offline gifts that I can email the receipt to, I manually password protect each pdf. We have low volume of these so its ok for now. I have a password keeper tool, I use the same password for all of them. I update that password every few months, the password tool keeps the previous passwords. I am sure there is something out there, but I haven't had time to implement anything other than what I am doing. I am super frustrated that in Canada, NXT doesn't have any receipting capabilities or online donations forms. The US version has so much more functionality than we do.

Kim Wolcott

I think she is speaking about password protecting the receipt so I can't be edited, not so that you need a password to open the pdf.