The more we use NationBuilder in my work, the more this is starting to worry me. NationBuilder treats login security like a basic website from 2011.

No security questions, location or device recognition, text 2FA, email 2FA, CAPTCHA, authenticator integration, required password resets (i.e. quarterly), etc.

It is the only tool out of the 10+ systems I use at work daily that does not require or at least support 2FA… yet it houses some of the most sensitive data we own.

Requiring 2FA for control panel users and being able to dictate password requirements would be a huge step in the right direction. Offering mobile 2FA login to all website users would be even better.

Please consider prioritizing control panel security upgrades, especially before the 2020 cycle kicks in.

I clone a lot of donation pages in my work. Would love to see some movement on fixing this one!

It’d be great to have a filter criteria or notifications for ANY piece of contact information changing. Until then, NationBuilder can’t be trusted as a true enterprise database with dozens of users because there is no checks-and-balances for sensitive data changes, nor are there enough field or tag specific permissions.

Like my constituents can just go on the website and change their address to “STOP MAILING ME STREET” and I would have no idea until we get the returned mail. Because NB doesn’t have permissions for specific fields, an intern could go in and change someone’s name to something offensive, and I would have no idea until it’s too late. A staff member could accidentally remove an important tag, and well, unless I’m watching the activity stream like a hawk, I’m not going to know.

I work in a University environment, so things are a bit more bureaucratic for me than your average NB customer. That said, NB should take a tip from Blackbaud and Salesforce when it comes to complex data management and protecting sensitive fields.

Should also mention that this happens regardless of if you import the data or change it from the profile.

Good suggestion. This is just like Mailchimp’s Timewarp feature. Our metrics showed a huge improvement in email engagement metrics once we started using Timewarp.

This is a pretty big headache for us, too. We have a student membership program that regardless of started-on date, they always expires on June 1st.

Because we can’t set a specific date on the page, we have to leave the expiration blank on sign up forms, and batch update new members manually to have a consistent date.

The most frustrating part is the inconsistency… If the functionality is already available under Batch Update in a list, it should be the same on the page settings (and everywhere else).