CiviCRM Community Forums (archive)

I am the Secretary of Political Group and we are looking to change our website/database management/donation system and I have been doing a bit of research on the matter. I think that Joomla/CiviCRM is the best option for us, but when I go before the rest of the board I will have to justify my choice. I have a pretty good handle on the benefits of CiviCRM, but I do have a few questions.

I know that a few of the board members who are not technically oriented have mentioned that they are a little afraid of "open source stuff" and would prefer to have a third party that they can blame/sue if things go wrong. So I know that in addition to selling them on the benefits of CiviCRM, I will also need to address their security concerns. That being said:

1. What are the security concerns that I should be aware of? I know that every password needs to be a nice strong password, to secure mysql database and that I should restrict access to those that need it. I've read that I need to make certain files in my Joomla/CiviCRM installation unwritable. I know that backups of the site need to be kept in a secure location. I've thought about using SSL, but by the time I pay for the SSL certificate, I may as well just keep our current website/db management provider, as the savings would be minimal. There is not a central office for our organization, so the computers using the system would be individual officer's and board member's own PCs. (That is probably my biggest concern). I would like to use Dreamhost, as I already know my way around their admin site, but I'm curious if there are any experiences you've had with security on their servers. Please let me know what security measures you have in place to protect your CiviCRM installs.

2. Do PayPal transactions, whether by credit card through PayPal or by PayPal account allow the amount of the donation to be tracked in CiviContribute and CiviMember? Also how would we be able to track info such as employer (for FEC filings) if the donation is handled by PayPal? I intend to recommend PayPal as our credit card processor, so I get around the issue of having to secure our donors/members credit card info (I think).

I apologize in advance for asking for help with this. But I know that you all know the answers better than I do and I need the best advice I can get.

Any help is appreciated