Is Finowl affordable for a small nonprofit?

Each lookup costs 1 credit, and 100 free credits arrive every month. Prepaid packs start at 10,000 credits for $29, and credits never expire.

Do we need a developer to integrate this?

Someone needs to add a server-side POST request to your donor platform. The quickstart at docs.finowl.co/quickstart shows a first request in a few lines.

Can we check our whole supporter list?

You can, within the 60 requests per minute rate limit, but most nonprofits get more value by checking at high-risk moments like gift changes and data access grants.

Email breach checks · Nonprofits

Email breach checks for nonprofit donor portals

Donor portals let supporters manage recurring gifts, update cards and download tax receipts, which makes them attractive to attackers who reuse leaked credentials. Checking an email against Finowl Intelligence tells you whether the address appears in known breaches and what data was exposed. For a small team, that single signal can decide when to ask for a one-time code without building a complex fraud system.

The same check works for volunteers and staff. Before a volunteer gets access to supporter lists, or a staff member is added to the fundraising CRM, an exposed address can prompt two-factor setup and a fresh password. Results never decide whether someone may donate or volunteer. They only shape how strongly an account is protected, keeping supporters safe without discouraging generosity.

Try it in the sandbox About email breaches

USE CASES

Where it fits in nonprofits

Recurring gift changes
Before a donor changes the card or bank account behind a recurring gift, check their email and send a one-time code if it appears in breaches that exposed passwords.
Volunteer access to supporter data
When volunteers are granted access to call lists or event rosters, check their email and require two-factor setup if the address shows exposure in password-leaking breaches.
Suspicious account creation
Combine breach status with velocity and card-decline signals to spot scripted account creation on donation forms, sending suspicious signups to email verification instead of blocking them.
Supporter care requests
When donors report unexpected changes to their account, supporter care staff can check breach context and quickly recognize likely takeover before restoring the donor's original gift settings and contact details.

HOW TO INTEGRATE

The workflow

1
Create an API key at app.finowl.co and store it as FINOWL_API_KEY in your donor platform's server configuration.
2
Call POST /v1/breaches/email before recurring gift changes and when volunteers or staff are granted data access.
3
Check breached and DataClasses to decide whether to request a one-time code or two-factor setup.
4
Fail open on errors so a donor can always complete a gift, and retry 429 responses after Retry-After.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "monthly.donor@example.com"
}'

Runs before a donor updates the card on a recurring gift. If the address appears in a password-exposing breach, confirm the change with a one-time code first.

GOOD PRACTICE

Before you ship

Never block a donation or volunteer signup on breach status alone. The goal is stronger account protection, and most supporters with breached emails are genuine.
Supporter data is personal data. Describe breach checks in your privacy notice and keep results in security tooling rather than donor profiles or fundraising segments.
Keep the experience warm. A short message thanking the donor and explaining a quick security step preserves goodwill far better than a cold block.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions