ChatGPT answers, unedited

• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States
• cre8 - Chicago, IL 60607
• Paul Gregory Media - 50 S Main St Suit 200, Naperville, IL 60540, United States
• Paul Gregory Media - 200 E 5th Ave, Ste 105, Naperville, IL 60563
• CSW Solutions Inc - 111 W Jackson Blvd Unit 1700, Chicago, IL 60604
• GiveCentral - 512 Chestnut St #277, Winnetka, IL 60093, United States
• Meyer Partners - 8745 W Higgins Rd Suite 110, Chicago, IL 60631, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States

If the requirement is “build us a secure, branded donation experience and keep PCI exposure low,” I would not hire a general web-design firm to build the payment processing themselves. I’d hire a nonprofit-experienced digital firm to build the site/UX and have the actual card transaction handled by a PCI-compliant payment/fundraising platform.

My Chicago shortlist

• Mightybytes, Inc. — my first call for a substantial website project. They’re Chicago-based and specialize in mission-driven organizations, with capabilities spanning strategy, UX/design, development, and ongoing optimization. Their profile also emphasizes accessibility and end-to-end web development. Orbit Media Studios
• Beth Interactive — best if fundraising performance is as important as the technology. They specialize in digital philanthropy and nonprofit donor engagement rather than being a generic web agency. I’d particularly consider them if you want donation conversion, email fundraising, and donor journeys optimized together.
• CharityGiving — best if the donation infrastructure itself is the priority. It is a Chicago-based fundraising/donation-management platform rather than primarily a website agency, with donation pages, recurring giving, donor records and reporting. Its materials reference PCI compliance and SSL.
• Cybernautic Web Design — good option for a custom website build. Their Chicago operation handles custom websites and has experience with payments/donations, accessibility, and organizations with more complicated content/workflow requirements.
• Spark Collective — worth considering for a smaller nonprofit that wants fundraising strategy plus digital execution. Their focus is specifically on mission-driven organizations and tying digital activity to measurable fundraising outcomes.
• CauseHouse — strong systems-oriented alternative, although not Chicago-local. They focus specifically on nonprofit digital infrastructure, fundraising systems, CRM integration and donor journeys.

Who I'd hire

For most established Chicago nonprofits, I'd put Mightybytes at #1 and Beth Interactive at #2.

I'd choose Mightybytes if you need a serious website rebuild—information architecture, accessibility, integrations, donation UX, performance and long-term technical ownership.

I'd choose Beth Interactive if your existing website is adequate and the bigger problem is raising more money online through better donor journeys, campaigns, email and conversion optimization.

If you mainly need a secure donation page rather than a new website, I'd actually skip a custom-built payment solution and investigate a dedicated nonprofit platform such as blackbaud.com or givesmart.com. Blackbaud says its donation forms are PCI compliant and can either be embedded in your existing CMS or hosted by Blackbaud; GiveSmart states that its platform is PCI and SOC 2 compliant. Blackbaud GiveSmart

The important PCI distinction

Don't accept a proposal that merely says “our website is PCI compliant.” Ask:

1. Who actually processes the card?
2. Does our website ever receive, transmit, or store raw card numbers?
3. Is payment tokenized/hosted by the PCI-compliant processor?
4. What PCI DSS responsibility remains with our nonprofit?
5. Can you provide your current PCI Attestation of Compliance (AOC) and relevant SOC 2 report?
6. How are recurring donations handled?
7. What happens if the website is compromised?
8. Who owns the donation data and can we export it?
9. How will the donation system integrate with our CRM/accounting system?
10. Who handles security patches, vulnerability testing, backups and incident response after launch?

A particularly good architecture is your branded website → secure/tokenized donation form → PCI-compliant payment processor, rather than your WordPress/custom application collecting credit-card numbers. For example, nonprofit web specialists such as Cornershop Creative explicitly describe using off-site/tokenized PCI-compliant payment services so sensitive payment data isn't stored in the WordPress database. Cornershop Creative

My recommendation: interview Mightybytes, Beth Interactive, and CharityGiving first, and make them quote the same donation architecture and integrations. That will give you a much more meaningful comparison than comparing three generic website proposals.

If you tell me your approximate annual online donations, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Raiser’s Edge, Bloomerang, etc.), and whether you need a full website rebuild, I can narrow this to the best 2–3 firms and give you a suggested RFP/scoring matrix.

• Promet Source - 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Sandstorm Design - 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
• Dialogue Theory - 1932 S Halsted St #509, Chicago, IL 60608, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• cre8 - Chicago, IL 60607
• Statement - 1033 South Blvd, Oak Park, IL 60302, United States
• Prosper Strategies - 200 W Madison St, Chicago, IL 60606, United States
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States

Yes. For a nonprofit, I would not hire a generic web-design shop to “make a PCI-compliant donation page.” I’d hire a firm that understands nonprofit fundraising and can architect the payment flow so your organization does not unnecessarily handle cardholder data.

Based on current Chicago-area options, these would be my shortlist:

My Chicago shortlist

1. Promet Source — best for security, complexity, and long-term ownership

DirectionsWebsite[Call](tel:+1 773-525-8255)

My first choice if your organization is medium-to-large or has demanding IT/governance requirements.

Promet is Chicago-headquartered and specializes in Drupal/WordPress, accessibility, security, integrations and ongoing support. It explicitly lists nonprofit experience, donation/payment management, CRM integrations and high-level security among its capabilities. Promet Source Promet Source

It's particularly attractive if your donation system needs to connect to Salesforce, a CRM, membership system, events, or multiple fundraising campaigns.

Best fit: established nonprofit, foundation, association, university, or organization with a substantial website and internal IT requirements.

prometsource.com

2. Mightybytes, Inc. — best overall nonprofit/mission fit

DirectionsWebsite[Call](tel:+1 773-561-7529)

This would probably be my second call, and potentially my first if fundraising UX and nonprofit strategy matter as much as technical architecture.

Mightybytes is Chicago-based, has worked with impact organizations since 1998, and has actual Chicago nonprofit clients including the Chicago Community Trust and Chicago Children's Choir. Mightybytes Mightybytes Mightybytes

They also emphasize accessibility and build/design rather than treating the website as simply a technical project.

Best fit: nonprofit that wants a polished donor experience, strong storytelling, accessibility, and a strategic digital partner.

mightybytes.com

3. Sandstorm Design — best for a sophisticated donor experience

DirectionsWebsite[Call](tel:+1 773-348-4200)

Sandstorm is another strong Chicago option. It specializes in purpose-driven organizations and nonprofits and has substantial UX/accessibility expertise. Its nonprofit practice cites 20+ years of nonprofit experience and work with organizations including foundations and education-focused nonprofits. Sandstorm Design Sandstorm Design

I'd put them high on the list if you're redesigning the whole digital fundraising experience, rather than merely adding a donation form.

Best fit: larger nonprofit with ambitious UX, accessibility, content, and digital-strategy requirements.

sandstormdesign.com

4. Dialogue Theory — strong mission-driven alternative

DirectionsWebsite[Call](tel:+1 617-922-3790)

Dialogue Theory is a Chicago digital studio focused on mission-driven organizations, nonprofits and civic work. It's worth including if you want a smaller, more collaborative agency rather than a large development operation.

Best fit: organization that values strategy, storytelling and a close agency relationship.

5. Cybernautic Web Design — worth considering for a more conventional custom build

DirectionsWebsite[Call](tel:+1 312-878-1986)

Cybernautic has Chicago presence and experience with custom websites, payments/donations, accessibility and organizations with more complicated content/workflow needs.

Best fit: smaller-to-mid-sized organization wanting a custom website without necessarily undertaking an enterprise-scale digital transformation.

Who would I hire?

If I were advising your board, I'd narrow it to three RFP candidates:

My default recommendation: Mightybytes. They have unusually relevant nonprofit experience, including Chicago Community Trust, while still providing serious digital-development capabilities. Mightybytes

But if PCI/security is your overriding concern, I'd interview Promet first. Their background in secure, governed Drupal environments and complex organizations makes them particularly compelling for a security-sensitive build. Promet Source Promet Source Resources

One important PCI point

I'd change the wording of your RFP from:

"Build us a PCI-compliant donation page."

to something more specific:

"Design and implement a donation experience using a PCI-compliant payment processor, minimizing our PCI scope and ensuring that our website does not store or transmit raw cardholder data."

That's an important distinction. PCI compliance isn't simply a property of the webpage. Your organization, payment processor, hosting environment, integrations and handling of card data all affect your obligations.

For example, a good architecture can send the donor's payment information directly to a PCI-compliant processor and use tokens/hosted components rather than having your WordPress/Drupal server receive raw card numbers. Nonprofit web specialists explicitly recommend this kind of architecture. Cornershop Creative

I'd also consider using a nonprofit fundraising/payment platform rather than having the agency build payment processing from scratch. For example, Funraise states that it is PCI Level 1 certified, while Givecloud describes SOC 2 and PCI DSS controls. Funraise Givecloud

What I'd require in the RFP

Before selecting anyone, make these requirements mandatory:

• PCI DSS scope documented in writing
• Payment processor identified and its PCI certification documented
• No raw credit-card numbers stored in your CMS, database, logs or analytics
• Tokenized/hosted payment architecture where practical
• MFA for all administrative accounts
• WAF/CDN and automated vulnerability monitoring
• Regular CMS/plugin dependency updates
• Encryption in transit and at rest where applicable
• Secure backups and tested restoration
• Fraud/chargeback controls
• WCAG 2.2 AA accessibility target
• Privacy/data-retention documentation
• Incident-response procedure
• Penetration/security testing appropriate to the project's risk
• Clear ownership of source code, accounts and donor data
• Post-launch security maintenance included in the contract

Most importantly, ask each finalist to draw your proposed payment/data-flow diagram. You want to see exactly where donor information goes from the moment someone clicks Donate through payment, receipt, CRM synchronization and reporting.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you a suggested RFP scoring matrix.

mightybytes.com

3. Sandstorm Design — best for a sophisticated donor experience

Sandstorm is another strong Chicago option. It specializes in purpose-driven organizations and nonprofits and has substantial UX/accessibility expertise. Its nonprofit practice cites 20+ years of nonprofit experience and work with organizations including foundations and education-focused nonprofits. Sandstorm Design Sandstorm Design

I'd put them high on the list if you're redesigning the whole digital fundraising experience, rather than merely adding a donation form.

Best fit: larger nonprofit with ambitious UX, accessibility, content, and digital-strategy requirements.

sandstormdesign.com

4. Dialogue Theory — strong mission-driven alternative

Dialogue Theory is a Chicago digital studio focused on mission-driven organizations, nonprofits and civic work. It's worth including if you want a smaller, more collaborative agency rather than a large development operation.

Best fit: organization that values strategy, storytelling and a close agency relationship.

5. Cybernautic Web Design — worth considering for a more conventional custom build

Cybernautic has Chicago presence and experience with custom websites, payments/donations, accessibility and organizations with more complicated content/workflow needs.

Best fit: smaller-to-mid-sized organization wanting a custom website without necessarily undertaking an enterprise-scale digital transformation.

Who would I hire?

If I were advising your board, I'd narrow it to three RFP candidates:

My default recommendation: Mightybytes. They have unusually relevant nonprofit experience, including Chicago Community Trust, while still providing serious digital-development capabilities. Mightybytes

But if PCI/security is your overriding concern, I'd interview Promet first. Their background in secure, governed Drupal environments and complex organizations makes them particularly compelling for a security-sensitive build. Promet Source Promet Source Resources

One important PCI point

I'd change the wording of your RFP from:

"Build us a PCI-compliant donation page."

to something more specific:

"Design and implement a donation experience using a PCI-compliant payment processor, minimizing our PCI scope and ensuring that our website does not store or transmit raw cardholder data."

That's an important distinction. PCI compliance isn't simply a property of the webpage. Your organization, payment processor, hosting environment, integrations and handling of card data all affect your obligations.

For example, a good architecture can send the donor's payment information directly to a PCI-compliant processor and use tokens/hosted components rather than having your WordPress/Drupal server receive raw card numbers. Nonprofit web specialists explicitly recommend this kind of architecture. Cornershop Creative

I'd also consider using a nonprofit fundraising/payment platform rather than having the agency build payment processing from scratch. For example, Funraise states that it is PCI Level 1 certified, while Givecloud describes SOC 2 and PCI DSS controls. funraise.org givecloud.com

What I'd require in the RFP

Before selecting anyone, make these requirements mandatory:

For a nonprofit donation page, I would not hire a general web design shop based only on aesthetics. The right partner should understand:

• PCI DSS scope reduction (ideally keeping card data entirely off your servers)
• tokenized payment processing
• recurring giving flows
• donor CRM integrations
• accessibility (WCAG)
• security practices, monitoring, backups, and incident response
• nonprofit fundraising conversion strategy

A key point: your website vendor usually does not become “PCI compliant” by itself. The safest architecture is typically a secure donation processor (Stripe, Blackbaud, Funraise, Donorbox, etc.) handling payment data while your site embeds or links to a compliant donation experience. www.funraise.org

Chicago firms I would put on your shortlist

1. Mightybytes, Inc. — best overall fit for a sophisticated nonprofit

Mightybytes, Inc.
Mightybytes, Inc.
Web
Address: 1725 W Balmoral Ave, Chicago, IL 60640, United States
Phone: +1 773-561-7529
Why consider them: They specialize in mission-driven organizations and offer strategy, design, development, accessibility, and ongoing optimization. They are a strong fit if your donation page is part of a broader digital transformation rather than a simple form replacement.

Best for:

• mid-size to large nonprofits
• organizations needing integrations and governance
• accessibility-conscious builds

Ask them:

• “Which donation platforms have you integrated?”
• “How do you keep our PCI scope minimized?”
• “Can you provide security documentation and launch QA?”

2. Sandstorm Design — best for enterprise nonprofit websites

Sandstorm Design
Sandstorm Design
Web
Address: 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
Phone: +1 773-348-4200
Why consider them: Sandstorm has experience with mission-led organizations and complex web platforms, including Drupal/WordPress environments.

Best for:

• foundations
• universities
• large nonprofits
• organizations with complex content and governance needs

3. Promet Source — best for security-heavy or complex platforms

Promet Source
Promet Source
Web
Address: 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
Phone: +1 773-525-8255
Why consider them: They are known for open-source platforms, Drupal expertise, and work with organizations that require strong accessibility and governance practices.

Best for:

• large donor ecosystems
• custom integrations
• organizations with IT/security stakeholders

4. Dialogue Theory — best boutique option

Dialogue Theory
Dialogue Theory
Web
Address: 1932 S Halsted St #509, Chicago, IL 60608, United States
Phone: +1 617-922-3790
Why consider them: A smaller Chicago studio focused on digital experiences for mission-driven organizations.

Best for:

• nonprofits wanting senior attention
• redesigning a donation journey
• combining UX strategy with development

5. Windy City Web Solutions — best budget-conscious option

Windy City Web Solutions
Windy City Web Solutions
Web
Address: 801 S Wells St, Chicago, IL 60607, United States
Phone: +1 847-801-9482
Why consider them: They focus on WordPress builds, nonprofit websites, accessibility, maintenance, and donation integrations. windycitywebsolutions.com

Best for:

• small and mid-size nonprofits
• WordPress organizations
• straightforward donation upgrades

My hiring recommendation by nonprofit size

Beth Interactive is also worth considering if the bigger issue is increasing online giving conversion, donor journeys, and fundraising strategy rather than only building the page.

Questions I would put in your RFP

1. “Will you store any cardholder data?”

Preferred answer: No. We use a PCI-compliant payment processor and tokenization.

2. “What donation platforms do you have production experience with?”

Look for examples involving Stripe, Blackbaud, Funraise, Donorbox, Givebutter, Salesforce, or similar.

3. “Who is responsible for PCI compliance?”

They should clearly explain shared responsibility.

4. “How will you protect donor information?”

Expect answers involving:

• MFA
• least-privilege access
• secure hosting
• patching
• backups
• vulnerability management

5. “Can you show three nonprofit donation pages you built and the results?”

If I were choosing for a typical established Chicago nonprofit

My shortlist would be:

1. Mightybytes — strongest overall nonprofit/digital partner
2. Sandstorm Design — strongest enterprise choice
3. Promet Source — strongest technical/security choice
4. Dialogue Theory — strongest boutique partner
5. Windy City Web Solutions — strongest value option

I would run a paid discovery phase with the top 2–3 firms before committing to a full rebuild. The quality of their security architecture and donor-flow recommendations will tell you more than a portfolio alone.

For a nonprofit donation page, I would not hire a general web design shop alone. The right partner should understand three things together:

1. Donation conversion (UX, recurring gifts, campaign landing pages)
2. Payment security (PCI DSS-compliant payment flows, tokenization, avoiding storage of card data)
3. Nonprofit systems (Salesforce Nonprofit Cloud, Blackbaud, Bloomerang, Donorbox, Givebutter, Stripe, etc.)

A key point: your website developer usually should not handle raw credit-card data. A good architecture is a secure donation form/payment processor that is PCI compliant, embedded or integrated into your site, so your organization and web vendor minimize PCI scope. cornershopcreative.com

Here are Chicago-area firms I would put on your shortlist:

Who I would hire (depending on your situation)

If you are a small-to-medium nonprofit ($1M–$20M budget):
I would start with:

1. Mightybytes, Inc.
2. Windy City Web Solutions
3. Beth Interactive

If you are a larger nonprofit, hospital foundation, university, or national organization:
I would shortlist:

1. Promet Source
2. Sandstorm Design
3. Mightybytes, Inc.

Questions I would ask before signing anyone

Ask every finalist:

• “Will our site ever store, transmit, or process raw card numbers?”
• “What PCI DSS responsibility remains with our nonprofit versus the payment processor?”
• “Which donation platforms have you implemented: Salesforce, Blackbaud, Donorbox, Givebutter, Funraise, Stripe?”
• “Can you show three live nonprofit donation flows you built?”
• “How do you test recurring donations, failed payments, refunds, and receipts?”
• “Do you provide security monitoring, backups, patching, and incident response?”
• “Will we own the code, accounts, analytics, and integrations?”

My recommended selection process

I would invite three firms to a paid discovery phase (or detailed proposal):

1. Mightybytes — best overall nonprofit digital partner candidate.
2. Promet Source — best if security, integrations, and scale are priorities.
3. Beth Interactive — best if your main goal is increasing fundraising performance rather than only rebuilding technology.

If you tell me your nonprofit’s annual online giving volume, current platform (WordPress/Drupal/etc.), CRM (Salesforce/Blackbaud/etc.), and approximate budget, I can narrow this to a single recommended hire and a target project scope.

Yes. For a nonprofit, I’d avoid having a general web agency build its own credit-card payment system. The safer architecture is a strong Chicago web/digital firm + a PCI-compliant payment/donation platform, with the card data tokenized or handled entirely by the processor.

My Chicago shortlist

Why these rise to the top: Sandstorm has substantial enterprise/nonprofit web-development capabilities; Thirdwave has a strong custom-development/integration orientation; and Beth Interactive is specifically focused on philanthropy and donor engagement. The latter's work includes analyzing the journey from landing on a giving page through donation completion and stewardship. www.flamingoagency.com

Who I'd hire

If you're asking me to pick one without knowing your budget or existing technology: I'd interview Sandstorm Design first, and Beth Interactive second.

But I would make the RFP require them to use a PCI-compliant payment processor rather than storing card numbers on your website. That's a much more important architectural decision than whether the agency itself advertises "PCI compliance." For example, nonprofit web specialists describe using off-site/tokenized PCI-compliant payment services so sensitive card data isn't stored in the organization's WordPress database. cornershopcreative.com

For the donation platform, I'd evaluate options such as Give Lively, Funraise, Givecloud, or CharityWeb alongside your existing CRM. Funraise, for example, states that it is PCI Level 1 certified, while Givecloud documents PCI DSS and SOC 2 controls. www.funraise.org Give Lively similarly describes PCI Level 1 payment processing through Stripe and PayPal. www.givelively.org

What I'd put in the RFP

Require every bidder to answer these explicitly:

1. Where does cardholder data live? Ideally, nowhere in your CMS/server.
2. Which payment processor handles the transaction?
3. What PCI DSS responsibility remains with our nonprofit?
4. Who completes the SAQ and what type?
5. Is the donation form hosted, embedded, or tokenized?
6. Can we use Apple Pay/Google Pay and recurring donations?
7. Can donations flow automatically into our CRM/accounting system?
8. What happens if the donation processor is unavailable?
9. Do you perform vulnerability scanning and penetration testing?
10. What's included in post-launch security maintenance?
11. Can you provide nonprofit references with comparable donation volume?
12. Who owns the website code, accounts, analytics, and donor data?

One particularly important requirement: don't accept "we're PCI compliant" as the answer. Ask them to map exactly which PCI responsibilities belong to the agency, payment processor, hosting provider, and your organization.

If you tell me your approximate annual online donation volume, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Blackbaud, Bloomerang, etc.), and budget, I can narrow this to 2–3 Chicago firms and recommend the specific architecture I'd use.

For a nonprofit that needs a secure donation page with PCI compliance, I would not hire a general web designer alone. I would look for a firm that understands:

• PCI DSS-compliant payment flows (typically using Stripe, Blackbaud Merchant Services, PayPal, Classy, Donorbox, etc., rather than storing card data)
• Donation conversion optimization (recurring giving, mobile checkout, campaign pages)
• CRM integrations (Salesforce Nonprofit Cloud/NPSP, Blackbaud, EveryAction, Bloomerang, Neon One, etc.)
• Security practices (MFA, secure hosting, patching, access controls, backups)
• Accessibility (WCAG 2.1/2.2 AA)
• Nonprofit governance (training staff, documentation, maintainability)

Based on Chicago-area firms with nonprofit/digital experience, these would be my shortlist: clutch.co

My recommended shortlist

1. Mightybytes, Inc. — Best overall fit for a mission-driven nonprofit

Mightybytes, Inc.
Web
Address: 1725 W Balmoral Ave, Chicago, IL 60640, United States
Phone: +1 773-561-7529
Why consider them

• Strong nonprofit and purpose-driven organization experience
• Full digital strategy + UX + development capabilities
• Good fit if you need more than a donation form: storytelling, campaigns, analytics, accessibility, and ongoing improvement

Best for: mid-size nonprofits that want a strategic partner, not just a developer.

2. Sandstorm Design — Best for larger organizations and complex integrations

Sandstorm Design
Web
Address: 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
Phone: +1 773-348-4200
Why consider them

• Deep experience with mission-led organizations
• Strong UX, accessibility, and enterprise CMS work
• Better fit if you need integrations, governance, multiple stakeholders, or a large website rebuild clutch.co

Best for: foundations, universities, healthcare nonprofits, national nonprofits.

3. Promet Source — Best for technical complexity

Promet Source
Web
Address: 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
Phone: +1 773-525-8255
Why consider them

• Strong Drupal/open-source expertise
• Experience with complex content platforms and mission-driven organizations
• Good choice if your donation system needs to connect to multiple databases or enterprise systems

Best for: organizations with internal IT teams or complicated requirements.

4. Dialogue Theory — Best boutique/high-touch option

Dialogue Theory
Web
Address: 1932 S Halsted St #509, Chicago, IL 60608, United States
Phone: +1 617-922-3790
Why consider them

• Smaller studio model
• Focus on digital experiences for mission-driven organizations
• Potentially better if you want senior-level attention and a collaborative process

Best for: nonprofits that value strategy and close collaboration.

5. Advocate Creative — Best nonprofit communications partner

Advocate Creative
Web
Address: 320 N Damen Ave d301, Chicago, IL 60612, United States
Why consider them

• Nonprofit/foundation specialization
• Strong storytelling and communications background
• Good if the challenge is donor engagement as much as technology

Best for: advocacy organizations, foundations, community nonprofits.

Who I would hire by nonprofit size

Questions I would ask every finalist

1. “Who handles PCI compliance—the agency, our payment processor, or us?”

A good answer is usually: the site never stores card data; payments are handled by a PCI-compliant processor using hosted fields/tokenization.

2. “Can you show three nonprofit donation flows you built?”

3. “Which donation platforms have you integrated?”
   • Stripe
   • Blackbaud
   • Classy
   • Donorbox
   • Givebutter
   • Salesforce
   • Bloomerang

4. “What security controls are included after launch?”
   • MFA
   • vulnerability updates
   • backups
   • monitoring
   • admin access reviews

5. “Who owns the code, hosting account, analytics, and integrations?”

My recommendation if I were running the vendor selection

I would invite Mightybytes, Sandstorm Design, and Promet Source to a short RFP. They represent three different strengths: fundraising-focused digital strategy, enterprise nonprofit experience, and technical architecture.

Before choosing, I would make PCI architecture a scored requirement—not just ask whether they say “PCI compliant.” A trustworthy firm should explain exactly where donor payment data lives, what they manage, and what your organization is responsible for.

Yes. For a nonprofit, I would not hire a firm simply because it says “PCI compliant.” The strongest setup is usually:

Chicago web/digital firm + PCI-compliant payment/donation platform, with the payment provider handling card data rather than your website storing it.

Based on current Chicago-area options and their published nonprofit/security capabilities, I’d shortlist these:

Who I'd hire

My first call would be Soliant if you already use Salesforce or expect to. Their nonprofit practice specifically covers fundraising, donor management, website integration and Salesforce Nonprofit Cloud/NPSP, and they have demonstrated nonprofit donation implementations. www.soliantconsulting.com

If your primary objective is increasing donations rather than building a complicated technology stack, I'd put Beth Interactive first. Their specialization is digital philanthropy and donor engagement rather than generic corporate web development. bethinteractive.com

If you need a highly customized donation application with stringent technical/security requirements, I'd interview Simpalm alongside Soliant. Its Chicago practice explicitly advertises PCI-compliant web development and nonprofit fundraising functionality. www.simpalm.com

One important PCI point

I'd make this a requirement in the RFP:

Your firm must implement the donation page so that your organization does not store or transmit raw cardholder data, using a PCI DSS-compliant payment processor/tokenized payment integration.

That's much better than asking an agency to make your WordPress/database itself "PCI compliant." For example, nonprofit web specialists such as Cornershop Creative describe using off-site/tokenized PCI-compliant payment services so card data isn't stored in the WordPress database. cornershopcreative.com

You could pair the website with a PCI Level 1 fundraising platform such as Funraise, which currently states that it is PCI Level 1 certified, or Fundraise Up, which states PCI DSS Level 1 and SOC 2 Type II compliance. www.funraise.org

What I would put in your RFP

Require finalists to demonstrate:

• PCI DSS responsibility matrix — who is responsible for what
• No storage of full card numbers/CVV in your CMS or CRM
• Tokenized payment processing
• MFA for administrators
• WAF/firewall and malware monitoring
• Vulnerability scanning and penetration testing
• Automatic security updates and backups
• WCAG 2.2 AA accessibility
• Fraud/chargeback controls
• Recurring donations and Apple Pay/Google Pay
• Donor receipt and tax-document workflows
• Salesforce/CRM integration, if applicable
• Incident-response procedures and breach notification
• Written documentation of the PCI scope and annual compliance process
• At least 2 nonprofit references with comparable donation volume

My practical shortlist would be: Soliant + Beth Interactive + Simpalm. Have all three price the same donation architecture so you're comparing firms rather than three different interpretations of the project.

If you tell me your annual online donation volume, current website/CMS, CRM (e.g. Salesforce/Blackbaud), and approximate budget, I can narrow those three to a specific recommendation and identify the best donation/payment platform to pair with the firm.

Yes. For a nonprofit, I’d prioritize a firm that does not put raw card data on your website and instead integrates a PCI-compliant payment processor/donation platform. That generally reduces your PCI scope and ongoing compliance burden.

My Chicago shortlist

1. Plego Technologies — best for a custom build
   • Chicago-based custom web/software development firm.
   • Better fit if you need a donation experience integrated with a CRM, membership system, custom database, or other internal systems.
   • Their capabilities include web applications, cloud infrastructure, security and compliance work.
   • My pick if your donation page is part of a larger custom digital project.

2. Sandstorm Design — best for a larger, mission-driven organization
   • Chicago agency with a strong focus on purpose-driven organizations, UX, accessibility and enterprise web development.
   • Particularly attractive if you need a substantial website redesign in addition to the donation experience.
   • My pick if donor UX, accessibility and overall digital strategy matter as much as payment processing.

3. Cybernautic Web Design — good website-development option
   • Chicago agency doing custom websites and highlighting payments/donations and accessibility among its capabilities.
   • Worth including in an RFP, particularly for a WordPress/custom-site project.

4. CharityGiving — best if the donation infrastructure itself is the priority
   • Chicago-based fundraising/donation-management software company.
   • Its platform is specifically aimed at nonprofit fundraising and donation management, with PCI/SSL security claims.
   • This is potentially a better route than commissioning a developer to build payment functionality from scratch.

5. GiveCentral — another nonprofit-focused Chicago option
   • Chicago-area giving platform focused on online and recurring donations, fundraising pages and donor management.
   • Its materials cite PCI compliance and SOC 2-related security controls.
   • Worth considering if you want an established fundraising platform rather than bespoke payment development.

Who I'd hire

If you want a custom donation page integrated into your existing website/CRM: I'd start with Plego and Sandstorm.

If the primary objective is simply a highly secure, branded donation experience: I'd investigate CharityGiving/GiveCentral before paying an agency to build the payment infrastructure themselves.

That's because PCI compliance isn't just a checkbox for the developer. The architecture matters. For example, eWay Corp's nonprofit guidance specifically recommends architecting the site so the payment processor handles cardholder data rather than allowing that data to pass through the CMS. www.ewaycorp.com

You could also have a Chicago agency build the front-end donor experience while using a PCI-certified nonprofit fundraising/payment platform underneath it. Platforms such as Givecloud advertise PCI DSS and SOC 2 Type II controls, while Funraise says it is a PCI Level 1 certified service provider. givecloud.com

What I would put in your RFP

Don't simply ask, "Can you build a PCI-compliant donation page?" Ask:

• Who is the PCI-certified payment processor/service provider?
• Will our website ever receive, transmit, or store full card numbers or CVVs?
• What PCI DSS scope will remain with our nonprofit?
• Will you provide the appropriate PCI SAQ and responsibility matrix?
• How are recurring payments/tokenized payment methods handled?
• How are refunds, chargebacks and fraudulent transactions handled?
• What donor data goes into our CRM, and what data stays with the payment provider?
• Is the donation form accessible to WCAG 2.2 AA standards?
• What security testing, vulnerability scanning and penetration testing are included?
• Who handles security patches after launch?
• What happens if the agency relationship ends—do we own the code, accounts and data?
• Can you provide two nonprofit references with comparable donation volume?

One important distinction: “PCI compliant” by itself isn't enough. You want the vendor to explain how PCI compliance is achieved and exactly what your organization's remaining obligations are.

My recommendation: solicit proposals from Plego, Sandstorm, and CharityGiving, but structure the RFP so that the first two can propose an agency + PCI-certified payment-platform architecture rather than building payment processing themselves. That will give you a much safer apples-to-apples comparison.

If you tell me your annual online donation volume, approximate budget, current website/CMS (e.g. WordPress), and CRM (Salesforce, Bloomerang, Blackbaud, etc.), I can narrow this to the one I'd hire and the architecture I'd specify.

Yes. I’d treat this as two separate buying decisions: (1) who designs/builds the donor experience and integrations, and (2) which payment/donation platform actually handles card data. For PCI, I would strongly favor an architecture where your organization never handles raw card numbers and the payment processor hosts the sensitive payment fields.

My Chicago shortlist

Who I'd hire

My first choice would be Beth Interactive, assuming your organization wants a polished donation experience and wants the agency to think about fundraising results, donor journeys, campaigns and analytics—not merely code the page. They're unusually specialized: their stated focus is digital philanthropy and strategic communications for nonprofits, and they report $43.6M+ raised for clients in 2025. bethinteractive.com

I'd ask Beth Interactive to propose a solution using a PCI-compliant payment provider rather than building/storing payment-card functionality themselves.

For the actual payments layer, Stripe is a particularly strong option. Stripe specifically supports nonprofits, recurring donations, mobile-friendly checkout and fraud prevention, and says its infrastructure processes payments for millions of organizations. stripe.comwww.givelively.org

Another good architecture is to use a dedicated nonprofit fundraising platform. For example, Funraise states that it is a PCI Level 1 certified service provider, uses AWS infrastructure, encrypts data and follows OWASP development practices. www.funraise.org Give Lively similarly documents PCI Level 1 payment processing through Stripe and PayPal. www.givelively.org

The important PCI distinction

Don't accept a proposal that simply says "the donation page will be PCI compliant." Ask exactly:

1. Who is the PCI DSS–certified payment processor?
2. Does cardholder data ever touch our servers?
3. Will you use hosted/tokenized payment fields or a redirect/hosted checkout?
4. What PCI DSS SAQ will our organization have to complete?
5. Who maintains the compliance documentation?
6. How are recurring-payment tokens stored?
7. What happens if the website is compromised?
8. Do you provide vulnerability scanning, penetration testing and incident response?
9. Can our CRM receive donor/payment status without receiving card data?
10. Who owns the code, domain, analytics, donor data and integrations if we terminate the contract?

That architecture matters more than whether a web agency puts "PCI compliant" on its website.

My recommended procurement approach

I'd actually invite three proposals:

• Beth Interactive — best overall nonprofit fundraising partner.
• Glantz Design — best comparison for a custom web/UX build.
• CharityGiving or GiveCentral — best comparison against a purpose-built fundraising platform.

Then give all three the same requirements, including your expected annual donation volume, average gift, recurring-giving percentage, CRM (Salesforce/Raiser's Edge/Bloomerang/etc.), website CMS, accessibility requirements, reporting requirements and whether you need event/peer-to-peer fundraising.

If you tell me your nonprofit's approximate annual online donations, current website/CMS, CRM, and whether you need recurring gifts, I can narrow this to a specific recommendation and give you a vendor-by-vendor comparison of likely cost, PCI architecture, integrations, and implementation risk.

Yes. For a nonprofit, I would not hire a generic Chicago web-design shop to build a custom credit-card form from scratch. I’d hire a firm that understands nonprofit fundraising UX and has the technical discipline to keep cardholder data out of your website wherever possible.

My Chicago shortlist

1. Beth Interactive — my overall recommendation

Beth Interactive

This is the firm I'd interview first. They're Chicago-based and specifically focused on digital philanthropy, donor engagement, annual giving and nonprofit fundraising, rather than treating a donation page as just another website form. Their current site says they've raised $43.6M+ on behalf of clients in 2025 and work with nonprofits nationwide. bethinteractive.com

They also perform digital donor-journey audits, examining the experience from arriving at the giving page through completing the donation and receiving the acknowledgment. bethinteractive.com

Caveat: I'd make them prove their PCI architecture in the proposal. Their fundraising expertise is clear, but I wouldn't assume that means they themselves are your PCI-compliant payment processor.

2. Dialogue Theory — best for a sophisticated rebuild

Dialogue Theory

I'd put them on the shortlist if you're looking for a broader website + digital experience project rather than simply a donation-page redesign. Their Chicago operation focuses on mission-driven organizations and complex digital initiatives; they've also built multilingual experiences for major Chicago nonprofits. www.dialoguetheory.com

For PCI, I'd require them to integrate a PCI-compliant payment provider rather than handle raw card data themselves.

3. LimeRed Studio — best design/mission fit

LimeRed Studio

LimeRed is particularly interesting if your donation page needs to be part of a larger brand, storytelling and UX overhaul. Their Chicago office focuses on purpose-driven organizations and nonprofit clients, with web design/development among their capabilities.

Again, I'd make PCI architecture a contractual requirement rather than relying on a generic "secure website" promise.

An important distinction about PCI

I'd actually make this the centerpiece of your RFP.

The safest architecture is usually:

Your website → secure donation component/payment processor → card network

rather than:

Your website → your own server → credit-card information

For example, nonprofit platforms such as GoFundMe Pro state that they're a PCI DSS Level 1 service provider and use payment partners such as Stripe and PayPal. www.classy.org Funraise similarly states that it is PCI Level 1 certified. www.funraise.org

That means your agency can concentrate on making the donation experience beautiful and conversion-oriented while a specialized payment platform handles the most sensitive payment infrastructure.

Who I'd hire

If you're a typical established nonprofit:
I'd invite Beth Interactive, Dialogue Theory and LimeRed to pitch.

If fundraising performance is the #1 objective: Beth Interactive is my pick.

If you're rebuilding your entire digital ecosystem: Dialogue Theory would probably be my pick.

If this is primarily a brand/website redesign with a donation component: LimeRed is compelling.

I would not select based on the phrase "PCI compliant" in a proposal alone. Ask each finalist these five questions:

1. Will our website ever receive, process, transmit or store raw card numbers?
2. Exactly which payment processor/donation platform will handle the card transaction?
3. Who is responsible for PCI DSS compliance—the agency, us, or the payment provider—and what documentation will we receive?
4. Can you provide the provider's current PCI Attestation of Compliance (AOC) or equivalent evidence?
5. What happens if the donation platform or integration is compromised, and who handles incident response?

I'd also require WCAG 2.2 AA accessibility, MFA for administrators, least-privilege access, encrypted connections, automated backups, vulnerability/patch management, fraud controls, and a written incident-response process. Secure payment processing alone doesn't make the entire donation experience secure.

Bottom line: If you give me your approximate annual online donation volume, current website/CRM (e.g. WordPress, Salesforce, Blackbaud), and budget, I can narrow this to the 2–3 firms I'd actually put in your RFP and tell you what I would ask each one to build.

Yes. For a nonprofit, I would not hire a general web designer to build the payment processing itself. I’d hire a strong nonprofit web firm to build the site/donation experience and have the actual card handling occur through a PCI-compliant payment/fundraising platform. That materially reduces your PCI exposure.

My Chicago shortlist

1. Sandstorm Design — my first call for a larger nonprofit.
Sandstorm specifically works with nonprofits and says its nonprofit practice combines UX research, conversion strategy and scalable technology to improve donations. Its portfolio includes organizations such as the Illinois Holocaust Museum & Education Center and MPN Research Foundation. www.sandstormdesign.com

The caveat is cost: current third-party project data puts its minimum project size around $100,000, so I wouldn't choose it for a relatively simple donation-page project. clutch.co

2. Promet Source — my choice if security, accessibility and complex integrations dominate.
Promet is headquartered in Chicago and specializes in secure, scalable open-source websites for mission-driven organizations. It has particularly deep Drupal experience and emphasizes accessibility and ongoing security/maintenance. www.prometsource.comwww.prometsource.com

3. Flamingo Agency — probably the most sensible option for a smaller organization.
Flamingo specifically markets nonprofit sites in Chicago, builds in WordPress, and says it integrates Stripe, PayPal and other nonprofit payment systems for one-time and recurring donations. It publicly estimates many nonprofit projects at $4,000–$10,000, although your actual quote could be considerably different. www.flamingoagency.com

4. Big Human — worth an RFP if you need custom functionality.
Big Human explicitly offers nonprofit development, secure donation forms, security/QA/compliance validation, and integration with CRMs and payment systems. www.bighuman.com

The important PCI distinction

I'd put this requirement in your RFP:

The agency must not store, process, or transmit raw donor cardholder data through the nonprofit's website infrastructure. Payment processing must be performed by a PCI DSS-compliant payment service provider using hosted fields, tokenization, or an equivalent architecture.

That's preferable to asking an agency to make your WordPress/Drupal server itself "PCI compliant."

For example, Funraise says it is a PCI Level 1 certified service provider, while Give Lively describes its use of PCI Level 1 payment processors. Givecloud reports SOC 2 Type II auditing and PCI DSS compliance for its payment environment. www.funraise.org

A good implementation could therefore look like:

Your website → branded/embedded donation experience → PCI-compliant processor → CRM

rather than:

Your website → credit-card numbers → your server/database

Who I would hire

If your organization is established and the donation system is strategically important, I'd invite Sandstorm + Promet + one lower-cost firm such as Flamingo to bid.

If I had to pick one without knowing your budget, I'd lean Promet Source because the combination of Chicago presence, nonprofit/mission-driven experience, accessibility, security and scalable technical architecture is unusually well aligned with what you're asking for. www.prometsource.comwww.prometsource.com

If you're a smaller nonprofit with a $5k–$20k-ish web budget, I'd lean toward Flamingo + a proven PCI-compliant donation platform, rather than paying an agency to custom-build fundraising infrastructure. www.flamingoagency.com

If you're doing a six-figure institutional website/digital transformation, I'd put Sandstorm at the top of the RFP list. clutch.co

If you tell me roughly your annual online donations, website budget, current CMS (WordPress/Drupal/etc.), CRM (Salesforce, Blackbaud, Bloomerang, etc.), and whether you need recurring donations, I can narrow this to the best 2–3 firms and recommend the exact donation/PCI architecture I would put in the RFP.

Yes. For a Chicago nonprofit, I’d hire a nonprofit-focused digital agency to build the donor experience, but have a PCI-validated payment provider handle the actual card data. That distinction matters: PCI DSS compliance isn't something a web agency can simply “add” to a page. PCI SSC says that for the simplest SAQ A model, payment-page elements must originate from PCI-compliant service providers, with the applicable eligibility criteria met. www.pcisecuritystandards.org

My Chicago shortlist

Why Beth Interactive is my #1: it is unusually focused on digital philanthropy, rather than being a general web shop. The Chicago firm works specifically with nonprofits on donor engagement, annual giving, communications and analytics, and says it raised $43.6M+ on behalf of clients in 2025. bethinteractive.com

Beth Interactive

Mightybytes is another particularly strong option if accessibility, security, sustainability and responsible technology matter to your board. It's a Chicago Certified B Corp, has extensive purpose-driven/nonprofit experience, and says its deliverables meet WCAG 2.2 AA by default. www.mightybytes.com

Mightybytes

EDUCO is attractive if this is really a website redesign + fundraising experience project. It specializes in nonprofits and says it has more than 20 years of nonprofit web-design experience, including work with LISC Chicago, Women Employed, Housing Forward and BUILD Chicago. www.educowebdesign.com

EDUCO

Dialogue Theory is the one I'd investigate for a more ambitious custom build. It explicitly works with nonprofits and civic organizations and handles strategy, design and development of digital experiences. www.dialoguetheory.com

Dialogue Theory

The architecture I'd require

I would not ask the agency to build a form that directly collects and stores credit-card numbers.

Instead:

Your website → branded donation experience → PCI-validated payment provider → processor

The agency should integrate something such as a PCI Level 1 nonprofit fundraising/payment platform. For example, Funraise states that it is PCI Level 1 certified, while GoFundMe Pro likewise identifies itself as a PCI DSS Level 1 service provider. www.funraise.org

That gives you a much cleaner security model and reduces the amount of PCI scope your organization has to manage. PCI SSC specifically distinguishes between fully outsourced payment processing and embedded payment forms, with different SAQ implications. www.pcisecuritystandards.org

Who I'd hire

If I were running your procurement process, I'd invite three firms to bid:

1. Beth Interactive — best fundraising/donor-conversion candidate.
2. Mightybytes — best security/accessibility/responsible-web candidate.
3. Dialogue Theory or Adage — best candidate if you need significant custom technology/integrations.

Then I'd award the work to whoever can demonstrate the strongest combination of nonprofit fundraising UX + PCI architecture + CRM integration, rather than whoever produces the prettiest mockup.

One important procurement requirement: ask each finalist to name the exact payment provider, provide its current PCI Attestation of Compliance (AOC), explain whether your organization will qualify for SAQ A or another SAQ, and specify exactly what donor/card data will touch your website, CMS, analytics tools and servers. Don't accept “PCI compliant” as a sufficient answer.

If you tell me your approximate annual online donation volume, current website/CMS (e.g. WordPress), CRM (Salesforce, Raiser's Edge, Bloomerang, etc.), and budget, I can narrow this to the single firm I'd hire and the payment stack I'd pair with it.

Yes. For a nonprofit, I would not hire a general web agency to build a custom credit-card form from scratch. The safer architecture is for the agency to build the donation experience while a PCI-validated payment provider handles card data. PCI SSC says fully outsourced/third-party payment pages can reduce the merchant's PCI scope, although the website still has PCI responsibilities. www.pcisecuritystandards.org

My Chicago shortlist

Who I would hire

If you're a medium-to-large nonprofit, my first call would be Soliant. Their combination of nonprofit fundraising, Salesforce, website integration and payment-platform experience is particularly compelling. Their documented Philadelphia Bar Foundation project included donations and fundraiser/event management, and they explicitly discuss integrating donation forms and payment processors. www.soliantconsulting.com

I'd put Sandstorm second if you're undertaking a major brand/site redesign, and Cybernautic second/third if the project is primarily a secure, well-designed website and donation experience rather than a major CRM transformation.

One important caveat about "PCI compliant"

Put this requirement into your RFP:

The vendor must design the donation flow so that our organization does not receive, transmit, or store raw cardholder data, and must document the resulting PCI DSS scope, applicable SAQ, payment processor responsibilities, and required security controls.

That's more meaningful than simply asking, "Are you PCI compliant?"

For example, PCI SSC distinguishes between a payment page where the PCI-compliant processor supplies all payment-page elements and one where your website supplies some of those elements. The latter can result in a broader PCI assessment (e.g., SAQ A-EP rather than SAQ A). www.pcisecuritystandards.org

I'd also require the selected vendor to provide:

• PCI DSS responsibility matrix / shared-responsibility document
• Payment processor's current PCI compliance documentation
• Written data-flow diagram showing where donor/card data goes
• No storage of CVV or raw card numbers by your organization
• Encryption in transit and at rest
• MFA for administrative accounts
• Vulnerability scanning and patching
• Web-application firewall/CDN where appropriate
• Audit logging and incident-response procedures
• WCAG 2.1 AA accessibility testing
• Secure recurring-donation/tokenization architecture
• A documented process for PCI SAQ completion and annual validation

One more option: if you don't actually need a custom payment system, I'd seriously consider having one of these Chicago firms build the website around a mature nonprofit fundraising platform rather than developing the payment infrastructure themselves. Blackbaud, for example, states that its donation forms are PCI compliant and that it encrypts/tokenizes card information; Givecloud similarly advertises PCI DSS and SOC 2 controls. www.blackbaud.com

If you tell me your approximate annual online donations, current website/CRM (WordPress, Drupal, Salesforce, Blackbaud, etc.), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you an RFP scoring matrix.

Yes. For a nonprofit that needs a secure, PCI-conscious donation experience, I would not hire a generic web designer and ask them to “make the donation form secure.” I’d hire a firm that has demonstrable nonprofit fundraising experience and build the payment flow so that raw card data never reaches your website’s servers. Stripe, for example, supports hosted donation pages and payment components specifically designed to reduce the PCI burden. support.stripe.comstripe.com

My Chicago shortlist

Who I'd hire

I'd start with Cybernautic. They are the strongest match I found for your specific combination of Chicago + nonprofit + custom website + secure online donations. Their Promise Council project is particularly relevant: they describe building a mobile-friendly donation platform supporting one-time and recurring gifts, and they have a dedicated online-payment implementation using Stripe. www.cybernauticdesign.com

I'd then get a competing proposal from CharityGiving if your primary concern is the fundraising/payment infrastructure rather than a complete website redesign.

If your organization already has a good website and you're really asking, “Who should build just the donation page?”, I would actually consider not having an agency build the payment processing at all. Have the agency build the donor-facing experience around a PCI Level 1 processor such as Stripe. Stripe offers hosted donation pages, recurring donations and customizable payment experiences, and eligible U.S. nonprofits can request nonprofit processing rates. stripe.com

The security requirement I'd put in your RFP

Don't simply write “PCI compliant.” Require the vendor to explain:

1. Where card numbers are entered.
2. Whether card data ever touches your servers, WordPress database, CRM, analytics tools, or logs.
3. Which PCI-certified payment processor is being used.
4. Whether the processor provides tokenization rather than storing card numbers in your systems.
5. How recurring donations and failed-card retries work.
6. How they prevent card-testing/fraud attacks.
7. Who is responsible for the nonprofit's PCI documentation and annual compliance obligations.
8. MFA, role-based access and audit logging for staff.
9. Vulnerability scanning, patching, backups and incident response.
10. How donor data gets transferred into your CRM without exposing payment information.

That architecture matters more than the agency's marketing claim that its “website is PCI compliant.” Stripe's own nonprofit guidance specifically recommends hosted donation forms, PCI Level 1 processors, tokenization, fraud detection and minimizing manual handling of payment data. support.stripe.comstripe.com

My ranking for your situation:
1. Cybernautic → 2. CharityGiving → 3. Flamingo Agency → 4. Nonprofit Megaphone → 5. UHA Solutions.

If you tell me your annual online donation volume, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Bloomerang, Blackbaud, etc.), and approximate budget, I can narrow this to the one I'd hire and the payment architecture I'd specify in the contract.