GoodStanding

353,663 revoked organisations on file, counted 2026-09-16Two packs, $79 and $199, charged once

IRS Auto-Revocation List · CA Registry of Charitable Trusts

Security

What GoodStanding stores, who else processes it, and how to report a vulnerability.

Reporting a vulnerability

Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

GoodStanding has no user accounts. There is nothing to sign in to, no password to reset and no session to steal, and a build gate fails the deploy if an authentication route ever appears in this repository while this page still says otherwise.

What is stored

  • The EIN or organisation name you type into the diagnostic is logged with the result, so that a lookup that found nothing can be told apart from one that was never run
  • If you use the contact form or the newsletter box, the address and message you send are relayed to us by email and a copy of the row is kept
  • If you buy, Stripe collects your billing address and your card
  • Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings and no profile is created for a visitor who never identifies themselves

Who else processes data

  • Stripe — takes the payment and holds the card details — we never see a card number
  • Supabase — the database behind the diagnostic and the rows it logs
  • Resend — delivers the contact form to our own mailbox
  • PostHog — anonymous product analytics, proxied through this domain
  • Vercel — serves this site and holds its access logs

Also true

  • The organisation records the diagnostic searches are public — they are the IRS's own published revocation and delinquency lists. Nothing about a nonprofit is added to them here.
  • Payment pages are Stripe's own hosted checkout on a Stripe domain, so a card number is never typed on this site.

GoodStanding is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.