How it fits together
From letter to your CRM, in five hops.
Supporter
Gets a letter or email with a QR code or personal code.
Your website
The Foundry box, on a page you choose, in your brand.
Foundry
Checks who it is, records the declaration and its evidence.
Your portal
Every answer sorted: ready, new address, to match, declined.
Your CRM or Cascade
Download a file, send it straight into Cascade, or use our API to send your declarations wherever you need them, automatically.
What your team actually does
Three steps. One of them is code.
1
Add one line to a page
Any site that lets you paste HTML: WordPress, Wix, Squarespace, Drupal or hand-built. About an hour, once.
2
Tell us the page address
We print it on the letters and emails, so supporters land on your page.
3
Get the results
Download each list as a file for your CRM, or use our API to send your declarations wherever you need them, automatically.
What it does, and what's next
Built for today. Ready for what's next.
At launch
At launch
The Foundry box
One line on any page; takes your logo and colours.
At launch
Gift Aid in your own forms (Flow)
The same line adds the Gift Aid question to donation and event forms.
At launch
Results by list
Waiting 30 days, Ready to claim, New address, To match, Declined: each downloads as a CSV.
At launch
Evidence on every declaration
One click from any result to the record behind it, and a PDF of every declaration to keep.
At launch
Your appeal code on every result
Save your own campaign code; it comes back on everything we send.
At launch
API and webhooks
Send your declarations wherever you need them, automatically, as they happen.
At launch
The “enter your code” box
A small box for any other page, so supporters start from wherever they land.
At launch
Campaign QR codes
One code per cold mailing, poster or event, with the channel recorded.
At launch
Whitemail export
Supporters' other replies, by type, ready for your CRM.
At launch
Straight from Cascade
Pick supporters in Cascade; answers land back on the record it claims against.
At launch
A test line
Example supporters, so you can try every path before you go live.
At launch
Each charity kept separate
Your data is walled off from every other charity's.
Security at a glance
Safe on your site.
✓
Your server never sees the code
The QR code carries only the letter's code, after the #, so it never reaches your web server.
✓
A code alone opens nothing
A supporter also needs their postcode. A wrong code and a wrong postcode get the same answer.
✓
Tamper-proof
The integrity hash means a changed or tampered file simply won't run on your page.
✓
Works with your security policy
Using a Content Security Policy? Add the Foundry address to script-src and frame-src.
✓
Nothing on your pages
Everything about a supporter stays inside the Foundry box. Your pages and address bar never show it.
✓
Only what's needed is kept
Only the reference, name, address, email (if they've agreed to email) and first-gift year. Rows we hold back, and your file itself, are not kept.
Data protection, hosting and contract questions: talk to us and we'll send your IT or data lead the detail.
Your data
Your data, protected.
Foundry launches in November 2026. These protections are built and tested today.
Each charity locked to its own records
Every table is locked to its charity by the database itself, not just by our code. A charity's sign-in can only ever see its own rows.
Evidence that can't be rewritten
Every declaration keeps the exact words the supporter saw, a fingerprint of that page and a tamper-evident chain. Our software's own login can't delete or rewrite a declaration.
Encrypted, and not on the open internet
Data is encrypted in transit and at rest. The database accepts encrypted connections only, through Google's secure connector.
Stored in London
Your data is stored in London on Google Cloud. Encrypted backups are kept in the UK and the EU.
Backed up every day
Daily backups, with restore to any second in the last 7 days. We test restores.
Codes we never keep
A letter code is 11 characters with a check character for typos. We never store the code itself, only a keyed fingerprint. Nothing shows until the code and the postcode both match.
Guessing is stopped
Each code allows 3 wrong postcodes, and each internet address is limited to 20 failed tries in 15 minutes.
Multi-factor sign-in for your team
Charity staff sign in through Frametric with a second factor. Every bulk export asks for a recent second factor too.
Every view and download logged
Who, when and what, for every download and every view of a full record. Supporter addresses show masked on screen.
CRMs
Works with yours
Foundry works with any CRM: download a file, or use our API to send your declarations wherever you need them, automatically. Cascade already works with Salesforce, Blackbaud, Microsoft Dynamics, Donorfy, Access, Advanced, SugarCRM and spreadsheets.
More detail
Supporters, gifts and declarations flow into Cascade from the system you use today. System not listed? Talk to us.
Declarations
Evidence built in
HMRC's model declaration wording, one box the supporter ticks themselves, a confirmation by email when the supporter has given one, and an evidence record for each declaration.
More detail
Foundry Vault keeps the web declarations you already hold in one place, each with the original record of how it was made, ready for when HMRC asks. Verbal declarations follow with Foundry Voice.
Your data
Always yours
Every declaration Foundry collects belongs to your charity, always. Every figure in Cascade traces back to the records behind it.
More detail
Upload a CSV of the supporters you want to ask, from any CRM. Every row is checked before anything is made, and rows held back come with the reason.
A question we haven't answered?
Your tech team can ask us directly. We reply within one working day.
