ChatGPT answers, unedited

• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Inova Web Design - 100 S State St, Chicago, IL 60603, United States

For a nonprofit, I’d separate “who can build the page” from “who should actually handle card data.” Ideally, your web firm builds the branded donation experience while a PCI-compliant payment processor handles the card information, so your website never stores raw card numbers. That substantially reduces your PCI scope.

Chicago firms I’d put on the shortlist

• CauseHouse — Strong nonprofit-specific option. They focus exclusively on mission-driven organizations and combine web development, donation flows, CRM integration, analytics, and fundraising strategy. Their positioning makes them worth interviewing if you want more than a basic donation form.
• Windy City Web Solutions — Good fit for a smaller/midsize nonprofit. They specifically build Chicago nonprofit WordPress sites, integrate online donation forms with donor systems, and offer ongoing security, hosting, backups, and support. Windy City Web Solutions
• Thirdwave — Worth considering for a more technically sophisticated build. They're a Chicago web-development firm with experience in nonprofit/education sites and integration-heavy digital platforms.
• Orbit Media Studios — A larger Chicago agency with substantial nonprofit web experience, including the Greater Chicago Food Depository and other nonprofit projects. They handle custom integrations and online donations. Orbit Media Studios
• Flamingo Agency — A Chicago nonprofit-focused agency that builds WordPress sites and integrates donation systems such as Stripe and PayPal. They report typical nonprofit projects in the $4,000–$10,000 range, although a security-sensitive donation project could cost more. Flamingo Agency

Who I'd interview first

I wouldn't make a hiring decision solely from these web results, but I'd start with CauseHouse and Orbit Media, then use Windy City Web Solutions as a smaller-agency comparison.

The reason isn't that either is objectively "best"; it's that their publicly documented nonprofit work appears particularly relevant to a project involving donations + integrations + donor experience, rather than merely building a general-purpose website. Orbit Media Studios

For the actual payment infrastructure, I'd also ask each firm to propose a PCI-compliant processor rather than accepting a custom system that puts card information on your server. For example, OneCause explicitly describes its donation forms as PCI compliant, while Givecloud describes PCI DSS and SOC 2 controls. OneCause Givecloud

The questions I'd put in your RFP

Ask every firm these exact questions:

1. “Will our website ever receive, store, or transmit raw credit-card numbers?”

Ideally, the answer is no.

2. “Exactly which payment processor will you use, and what is its current PCI DSS certification/status?”
3. “What PCI DSS responsibilities remain with our nonprofit?”

Don't accept simply “the site is PCI compliant.” You want them to identify the applicable PCI scope and your responsibilities.

4. “Can you provide the architecture/data-flow diagram showing what donor information goes from the browser → website → payment processor → CRM?”
5. “Where will donor PII be stored, and who has access to it?”
6. “Will recurring donations, Apple Pay/Google Pay, ACH, refunds, chargebacks and receipts be supported?”
7. “How will you protect the WordPress/CMS administration layer?”

Look for MFA, least-privilege access, patching, backups, monitoring and a documented incident-response process.

8. “Who owns the website, domain, code, analytics, payment account and donor data if we terminate the contract?”
9. “Will you provide documentation of the security controls and PCI responsibilities at launch?”
10. “Can you give us two nonprofit references for donation projects comparable to ours?”

One particularly good security pattern is the one described by nonprofit specialist Cornershop Creative: payment integrations use secure/tokenized PCI-compliant services so sensitive card information isn't stored in the WordPress database. Cornershop Creative

My practical recommendation: don't hire the firm that promises simply “a PCI-compliant donation page.” Hire the firm that can draw the payment/data architecture for your board, clearly assign PCI responsibilities, use a PCI-compliant processor, and demonstrate that card data never enters your website's database.

If you tell me your approximate annual online donation volume, current CRM (Salesforce/Bloomerang/Blackbaud/etc.), budget, and whether you need recurring donations, I can narrow this to 3 firms and give you a vendor-comparison/RFP scorecard without relying on generic agency rankings.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Doing Good Digital - 668 N Coast Hwy, Laguna Beach, CA 92651, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Inova Web Design - 100 S State St, Chicago, IL 60603, United States

For a Chicago nonprofit, I’d separate the decision into (1) the firm building the site/donation experience and (2) the payment processor that actually handles card data. PCI compliance is much easier to manage when your website never stores raw card numbers and the donation platform/payment processor handles the payment data.

A few Chicago-area firms worth putting on an RFP shortlist:

• Beth Interactive — Chicago-based and specifically focused on digital philanthropy/nonprofit fundraising. They emphasize donor journeys, fundraising strategy, analytics, and digital communications. This is a particularly relevant option if the project is as much about increasing online giving as it is about building a page.
• Windy City Web Solutions — Chicago-based WordPress shop with explicit nonprofit experience. Their nonprofit offering includes online donation integration, security/maintenance, backups, and accessibility. Windy City Web Solutions
• Thirdwave — Chicago digital product/web-development firm suited to a more technically sophisticated project involving integrations, custom functionality, hosting, and ongoing support.
• Cybernautic Web Design — Chicago-based full-service web firm that can handle design, development, hosting and ongoing digital work.
• CauseHouse — nonprofit-focused digital/growth studio; its positioning includes nonprofit websites, fundraising strategy, CRM architecture and campaign infrastructure.
• GiveCentral — worth considering if you want the donation infrastructure itself, rather than hiring an agency to custom-build payment processing. Its Chicago presence and materials emphasize online giving and PCI/SOC 2 security controls.

There are also strong non-Chicago firms that could be worth including in the RFP. For example, Cornershop Creative explicitly describes using PCI-compliant payment services and tokenized/off-site processing so card information isn't stored in the nonprofit's WordPress database. Cornershop Creative

Who I'd put through the final selection

Rather than declaring one universally "best," I'd invite Beth Interactive, Windy City Web Solutions, and Thirdwave to respond to the same requirements. They represent meaningfully different approaches: fundraising/donor optimization, nonprofit-focused WordPress implementation, and more custom technical development.

Your RFP should require each firm to answer these questions:

1. PCI: Exactly which PCI DSS-compliant payment processor will handle card data? What is the processor's current PCI certification/SAQ responsibility?
2. Card-data exposure: Will your website ever receive, transmit, or store raw PAN/card numbers?
3. Donation platform: Stripe, GiveCentral, Funraise, Givecloud, Donorbox, Salesforce-integrated system, etc.—and why?
4. Recurring gifts: Can it handle monthly giving, upgrades, failed-payment recovery and donor self-service?
5. CRM: How will donations flow into your CRM without manual exports?
6. Security: MFA, WAF, vulnerability scanning, patching, backups, logging, incident response and penetration testing.
7. Accessibility: Require WCAG 2.2 AA for the donation experience, not merely the rest of the website.
8. Compliance documentation: Ask them to identify precisely what your organization is responsible for versus what the payment processor/platform handles.
9. Ownership: Your organization should own the domain, website, data and accounts, with documented export procedures.
10. Post-launch: Get a fixed annual price for security maintenance and support.

One important point: "PCI-compliant website" isn't enough as a vendor claim. For example, Funraise publicly identifies itself as a PCI Level 1 certified service provider, while Givecloud describes PCI DSS and SOC 2 controls. Those are materially more useful things to verify during procurement than an agency simply saying "PCI compliant." funraise.org givecloud.com

If you tell me your approximate annual online donation volume, CRM (e.g. Salesforce/Bloomerang/Blackbaud), budget, and whether you need a whole new website or just a secure donation page, I can narrow this to a 3-firm shortlist and give you a side-by-side RFP scorecard.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Alphazeta - 325 W Huron St, Ste 506, Chicago, IL 60654
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Heller Consulting - 53 W Jackson Blvd, Ste 622, Chicago, IL 60604
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Yeeld - 1449 S Michigan Ave Ste 13260, Chicago, IL 60605, United States
• SITE IT NOW - 1016 W Jackson Blvd, Chicago, IL 60607, United States
• Alpha Efficiency - Web Design Chicago Agency - 875 N Michigan Ave, Chicago, IL 60611, United States
• cre8 - Chicago, IL 60607

Yes. For a nonprofit, I would not hire a generic web-design shop and ask them to “make the donation page PCI compliant.” The safer approach is to have the agency build the site/donation experience around a PCI-compliant payment provider, so your organization minimizes the amount of cardholder data it ever handles.

My Chicago shortlist

• Beth Interactive — My first call for a fundraising-focused nonprofit. They specialize in digital philanthropy and donor engagement, rather than treating the donation page as just another website form. Their services include donor-journey analysis and fundraising-focused digital work. Clutch
• Thirdwave — Best choice for a technically sophisticated organization. They're a Chicago web/digital-product firm with experience in complex CMS, integrations, hosting and ongoing support. I'd put them high on the list if the donation system needs to connect to a CRM, membership system or other backend.
• Cybernautic Web Design — Good option for a smaller/midsize organization. They explicitly offer secure online payments/donations, recurring payments and Stripe integrations, along with ongoing technical support.
• Alphazeta — Worth considering for a larger custom website where accessibility, integrations, hosting/security and ongoing development all matter.
• CauseHouse — Particularly interesting if you want a nonprofit-only partner. Its stated work includes donation-flow design, CRM-connected forms, UX/accessibility and fundraising-oriented web development.

There are also established Chicago nonprofit web firms such as Promet Source, Sandstorm Design, Chromatic and Mightybytes. Current industry listings show substantial nonprofit/web-development experience among these firms, although I'd require each one to demonstrate its specific payment-security architecture before selecting them. Clutch

Who I'd hire

For most established nonprofits, I'd start with Beth Interactive and Thirdwave and make them compete for the project.

My preference would depend on what you're actually building:

One important PCI point

Don't accept a proposal that merely says “PCI compliant website.” Ask:

“Exactly which party is PCI DSS compliant, what SAQ would our nonprofit have to complete, and will our servers ever receive, transmit, or store raw cardholder data?”

Ideally, the answer is that a PCI-compliant payment provider handles the sensitive payment information and your website receives only a token/result. For example, Funraise states that it is a PCI Level 1 certified service provider, while Givecloud describes its donation infrastructure as PCI DSS compliant and SOC 2 Type II audited. Funraise Givecloud

I'd also require:

• PCI DSS responsibility matrix identifying exactly what your organization is responsible for.
• Hosted/tokenized payment fields, rather than collecting card numbers in your own database.
• TLS everywhere, MFA for administrative accounts, secure hosting and automated patching.
• Fraud/velocity controls and monitoring.
• Recurring donations and Apple Pay/Google Pay if appropriate.
• WCAG accessibility testing.
• CRM integration without unnecessarily copying payment data.
• Written incident-response and breach-notification procedures.
• Annual security/PCI documentation from the payment provider.
• A post-launch maintenance/security agreement.

I would not choose the lowest bidder for this particular project. A $10k–$20k difference in development cost can be trivial compared with the reputational and operational consequences of a compromised donor-payment system.

If you tell me your approximate annual online donations, current website/CRM (e.g. WordPress, Salesforce, Blackbaud, Bloomerang, etc.), and your budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you an RFP/checklist to send them.

One important PCI point

Don't accept a proposal that merely says “PCI compliant website.” Ask:

“Exactly which party is PCI DSS compliant, what SAQ would our nonprofit have to complete, and will our servers ever receive, transmit, or store raw cardholder data?”

Ideally, the answer is that a PCI-compliant payment provider handles the sensitive payment information and your website receives only a token/result. For example, Funraise states that it is a PCI Level 1 certified service provider, while Givecloud describes its donation infrastructure as PCI DSS compliant and SOC 2 Type II audited.

I'd also require:

• Mightybytes - 4001 N Ravenswood Ave, Ste 404, Chicago, IL 60613
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States

Yes. I’d shortlist Chicago firms that understand both nonprofit fundraising UX and the security architecture around payments—not just agencies that can make a nice WordPress site.

My Chicago shortlist

1. CauseHouse — my first call

• Nonprofit-focused rather than a general web agency.
• Covers web development, fundraising strategy, CRM architecture, donation flows, accessibility, analytics, and campaign infrastructure.
• Best fit if you want the donation page, CRM, email, and fundraising journey designed as one system.
• I would ask them specifically to propose a PCI-minimizing architecture rather than building a custom card-data workflow.
• Mightybytes — best for security/accessibility-conscious organizations

• Chicago digital/product-development firm with a strong emphasis on responsible digital practices.
• A good candidate if accessibility, privacy, sustainability, and long-term maintainability matter alongside fundraising.
• I'd put them on the RFP if your organization is relatively sophisticated technically.
• Thirdwave — best for a more complex technical build

• Chicago web/product-development firm with experience in content-heavy nonprofit/education sites and integration-heavy platforms.
• Particularly interesting if the donation system needs to connect to a CRM, membership system, events, or other backend systems.
• Cybernautic Web Design — worth considering for a custom site

• Chicago-based web agency with experience in payments/donations, accessibility, portals, and ongoing support.
• More appropriate if you're looking for a custom website implementation rather than a fundraising-platform specialist.
• GiveCentral — consider as the payment/donation layer

• This is somewhat different from the agencies above: GiveCentral is a Chicago-based giving platform rather than simply a website-development firm.
• Its offering includes customizable giving pages, recurring giving, campaigns, and tokenized payment functionality; its published materials describe PCI and SOC 2 certifications. Funraise
• For many nonprofits, using a specialized PCI-compliant donation platform and having an agency build the surrounding experience is safer and cheaper than asking an agency to build payment processing itself.

Who I'd hire

If I were choosing for your organization without knowing anything else, I'd invite CauseHouse, Mightybytes, and Thirdwave to bid, with GiveCentral or another PCI-compliant processor/platform as part of the technical architecture.

My likely ranking:

There are also nonprofit specialists such as Flamingo Agency, which explicitly builds Chicago nonprofit sites with donation integrations and ongoing security/maintenance, and Simpalm, which reports 15+ years of nonprofit web experience and Chicago presence. Flamingo Agency Simpalm

One important PCI point

I would not make "PCI-compliant website" the requirement in your RFP without defining what you mean.

A better requirement is:

The website must be architected so that our organization and website infrastructure have minimal exposure to cardholder data, with payment processing handled by an appropriately PCI-certified payment provider, and the implementation must document our resulting PCI DSS responsibilities.

For example, Funraise states that it is a PCI Level 1 certified service provider, while eWay describes an architecture in which the payment processor handles cardholder data and the nonprofit website does not inadvertently expand its PCI scope. Funraise eWay Corp

That's the architecture I'd want your firm to explain—not simply a checkbox saying "PCI compliant."

What I'd put in the RFP

Ask each finalist these five questions:

• Exactly where does cardholder data enter our system?
• Does our website ever see, store, or transmit the full card number?
• Which payment processor/donation platform do you recommend, and what is its current PCI certification?
• What parts of PCI DSS remain our organization's responsibility after implementation?
• Will you provide a written data-flow diagram, security architecture, vulnerability-testing plan, and post-launch maintenance/security plan?

I'd also require WCAG 2.2 AA accessibility, MFA for administrative accounts, least-privilege access, encrypted connections, dependency/security patching, backups, logging, and a documented incident-response process. A nonprofit-focused agency should be comfortable addressing all of those.

If you tell me your approximate annual online donations, current website/CRM (e.g. WordPress, Salesforce, Blackbaud), and budget, I can narrow this to the 2–3 firms I'd actually invite to the RFP and give you a vendor scorecard with weighted criteria.

I would not make "PCI-compliant website" the requirement in your RFP without defining what you mean.

A better requirement is:

The website must be architected so that our organization and website infrastructure have minimal exposure to cardholder data, with payment processing handled by an appropriately PCI-certified payment provider, and the implementation must document our resulting PCI DSS responsibilities.

For example, Funraise states that it is a PCI Level 1 certified service provider, while eWay describes an architecture in which the payment processor handles cardholder data and the nonprofit website does not inadvertently expand its PCI scope.

That's the architecture I'd want your firm to explain—not simply a checkbox saying "PCI compliant."

What I'd put in the RFP

Ask each finalist these five questions:

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• LimeRed Studio, Inc. - 4611 N Ravenswood Ave, Chicago, IL 60640, United States
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Donately Corporation - 629 J St #205, San Diego, CA 92101, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States

Yes. For a nonprofit, I’d avoid having the web agency build or store raw card data themselves. The safer architecture is a branded donation page on your site, with payment handled by a PCI-compliant processor/gateway using tokenization or hosted fields. That can dramatically reduce your PCI scope.

Based on current Chicago-area options, I’d put these firms on your shortlist:

My Chicago shortlist

• Beth Interactive — Best if fundraising strategy is as important as the technology. They specialize in philanthropy/nonprofit digital work and donor journeys, including audits and analytics. This would be my first call for an established nonprofit that wants the donation experience optimized, not merely coded.
• LimeRed Studio, Inc. — Best overall nonprofit digital-agency candidate. They're Chicago-based and specifically work with nonprofits and purpose-driven organizations, including website development, accessibility, CRM/forms/payments integrations, training and ongoing maintenance.
• Windy City Web Solutions — Best for a smaller/mid-sized organization that wants hands-on support. Their nonprofit work includes donation integrations, accessibility, WordPress, security monitoring and backups. Windy City Web Solutions
• CauseHouse — Interesting option if you need the whole fundraising stack. Their positioning combines nonprofit web development, donation flows, CRM architecture, analytics and digital fundraising rather than treating the donation page as an isolated website project.
• Thirdwave — Worth considering for a technically complex organization. They're more of a sophisticated digital-product/web-development shop, making them attractive if the donation system needs substantial CRM, database, portal or integration work.
• GiveCentral — Consider this if you primarily need fundraising infrastructure rather than a new agency-built website. It's a Chicago-area nonprofit fundraising platform and publicly describes PCI and SOC 2 certifications.

Who I'd hire

If your organization is an established nonprofit with meaningful online fundraising, I'd start with LimeRed Studio and Beth Interactive.

I'd lean LimeRed if the project is primarily a secure website + donation experience + integrations. Their stated capabilities cover nonprofit websites, payments/CRM integrations, accessibility and ongoing maintenance.

I'd lean Beth Interactive if the bigger objective is increasing donations and improving the donor journey, with the technology supporting a broader fundraising strategy.

For a smaller nonprofit with a tighter budget, I'd talk to Windy City Web Solutions as the third quote. Their nonprofit portfolio specifically includes donation integration and ongoing security/maintenance. Windy City Web Solutions

The PCI requirement I'd put in your RFP

Don't simply ask an agency, "Can you build a PCI-compliant donation page?" That's too vague.

I'd require them to propose an architecture where:

1. Your website never stores raw card numbers or CVV data.
2. Payments are processed by a PCI-compliant payment provider.
3. Card information is tokenized/handled through the processor's secure components.
4. The agency explains exactly which PCI DSS SAQ applies to your organization and why.
5. They provide a written description of the payment-data flow.
6. MFA, least-privilege access, logging, backups, vulnerability management and software patching are included.
7. The donation system supports recurring gifts, refunds, receipts and failed-payment recovery.
8. Donor data is securely synchronized with your CRM rather than manually exported.
9. The site meets WCAG 2.2 AA accessibility requirements.
10. They commit contractually to ongoing security maintenance after launch.

There's a good reason to be strict here: nonprofit specialists such as Cornershop explicitly describe using off-site/tokenized PCI-compliant payment services so sensitive payment information doesn't reside in the WordPress database. Cornershop Creative

One important distinction

"PCI-compliant website" and "PCI-compliant payment processing" aren't the same thing. Your agency should be able to tell you exactly what your organization's PCI responsibilities remain after the processor handles the card transaction.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and whether you need one-time + recurring donations, I can narrow this to the 2–3 firms I'd actually invite to bid, including what I would ask each one and a realistic Chicago budget range.

• Orbit Media Studios - 4043 N Ravenswood Ave #316, Chicago, IL 60613, United States
• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Solid Digital - 100 N LaSalle St #1400, Chicago, IL 60602, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States
• CCS Fundraising - 155 N Wacker Dr #1790, Chicago, IL 60606, United States

Yes. For a nonprofit that needs a secure donation page with PCI compliance, I’d favor a Chicago agency that has real nonprofit fundraising experience and will keep cardholder data out of your website/WordPress database by using a PCI-compliant payment processor.

My Chicago shortlist

1. Orbit Media Studios — my first choice

DirectionsWebsite[Call](tel:+1 773-348-4581)

Orbit is the strongest overall fit if you're looking for a serious nonprofit website/donation experience rather than just a payment form.

They have extensive nonprofit experience, including the Greater Chicago Food Depository, Children's Home + Aid, Chicago CRED, and other Chicago nonprofits. Their nonprofit practice specifically covers online donations, integrations, UX, accessibility, and conversion optimization. Orbit Media Studios Orbit Media Studios Orbit Media Studios

They also have unusually deep Chicago nonprofit experience through Chicago Cause, which has provided hundreds of thousands of dollars in web/marketing services to local nonprofits. Orbit Media Studios

I'd hire Orbit if: your donation page is part of a broader website redesign, you have meaningful fundraising volume, or you need CRM/marketing integrations.

orbitmedia.com

2. Mightybytes, Inc. — best security/mission-oriented alternative

DirectionsWebsite[Call](tel:+1 773-561-7529)

Mightybytes is particularly compelling if your organization cares about security, accessibility, sustainability, and working with a mission-driven agency.

They've worked with organizations such as Chicago Children's Choir and Chicago Community Trust. Their deliverables are WCAG 2.2 AA by default, and they've been a Certified B Corp since 2011. Mightybytes Mightybytes Mightybytes

Their Chicago Children's Choir work is especially relevant because it involved a nonprofit website whose goals included increasing donations and event participation. Mightybytes

I'd hire Mightybytes if: security/accessibility and organizational values are weighted as heavily as fundraising conversion.

mightybytes.com

3. Thirdwave — best for a technically complex build

DirectionsWebsite[Call](tel:+1 312-329-1960)

Thirdwave looks attractive if you need more than a standard nonprofit website—for example, a sophisticated CMS, donor/member portal, multiple integrations, or a site that will need substantial ongoing technical support.

Its Chicago practice combines strategy, design, engineering, hosting and ongoing support, and its portfolio includes nonprofit and education organizations.

I'd hire Thirdwave if: your donation system needs to connect to a complicated existing technology stack.

4. Solid Digital — worth getting a competitive proposal

DirectionsWebsite[Call](tel:+1 877-899-9981)

Solid Digital has substantial Chicago nonprofit web-development experience and strong client reviews. Clutch specifically cites its work redesigning/developing a site for an animal-rights organization and rates its Chicago client feedback highly. Clutch

I'd include them in the RFP if you want a second/third quote from an established agency.

One important distinction about "PCI compliant"

I would not ask an agency simply to "make our website PCI compliant."

Instead, put this requirement in your RFP:

The website must not store, process, or transmit raw payment-card data. Online donations must be processed through a PCI DSS-compliant payment processor using hosted/tokenized payment fields, with the implementation designed to minimize the nonprofit's PCI DSS scope. The vendor must document the resulting PCI responsibilities and provide all relevant processor/AOC documentation.

That's a much better security architecture.

For example, nonprofit platforms such as Funraise state that they are PCI Level 1 certified, while OneCause explicitly advertises PCI-compliant donation forms. Funraise OneCause

A good web agency should therefore build the donor experience, integrations and branding while the payment infrastructure handles the sensitive card information.

Who I'd hire

If I were selecting for your organization without knowing anything else about your size or existing systems, my ranking would be:

1. Orbit Media — best overall nonprofit/fundraising website partner
2. Mightybytes — best if security, accessibility and mission alignment are paramount
3. Thirdwave — best for a technically sophisticated/integration-heavy project
4. Solid Digital — good additional competitive bid

My recommendation: start with Orbit and Mightybytes. Ask both to propose the same architecture: a branded donation experience on your site, PCI-compliant/tokenized payment processing, recurring donations, mobile optimization, accessibility, fraud controls, CRM integration, receipts, analytics, and an explicit delineation of PCI responsibilities.

One other option is to skip having an agency build the payment infrastructure at all and use a nonprofit fundraising platform. For example, Chicago-based GiveCentral advertises PCI/SOC 2 security and online fundraising, while Infinite Giving offers branded donation pages and multiple giving methods.

If you tell me your approximate annual online donation volume, current website platform (WordPress/Drupal/etc.), CRM (Salesforce, Bloomerang, Blackbaud, etc.), and budget, I can narrow this to the one I'd actually hire and give you a vendor-selection scorecard.

mightybytes.com

3. Thirdwave — best for a technically complex build

Thirdwave looks attractive if you need more than a standard nonprofit website—for example, a sophisticated CMS, donor/member portal, multiple integrations, or a site that will need substantial ongoing technical support.

Its Chicago practice combines strategy, design, engineering, hosting and ongoing support, and its portfolio includes nonprofit and education organizations.

I'd hire Thirdwave if: your donation system needs to connect to a complicated existing technology stack.

4. Solid Digital — worth getting a competitive proposal

Solid Digital has substantial Chicago nonprofit web-development experience and strong client reviews. Clutch specifically cites its work redesigning/developing a site for an animal-rights organization and rates its Chicago client feedback highly. Clutch

I'd include them in the RFP if you want a second/third quote from an established agency.

One important distinction about "PCI compliant"

I would not ask an agency simply to "make our website PCI compliant."

Instead, put this requirement in your RFP:

The website must not store, process, or transmit raw payment-card data. Online donations must be processed through a PCI DSS-compliant payment processor using hosted/tokenized payment fields, with the implementation designed to minimize the nonprofit's PCI DSS scope. The vendor must document the resulting PCI responsibilities and provide all relevant processor/AOC documentation.

That's a much better security architecture.

For example, nonprofit platforms such as Funraise state that they are PCI Level 1 certified, while OneCause explicitly advertises PCI-compliant donation forms.

A good web agency should therefore build the donor experience, integrations and branding while the payment infrastructure handles the sensitive card information.

Who I'd hire

• Mightybytes - 4001 N Ravenswood Ave, Ste 404, Chicago, IL 60613
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States

If your nonprofit needs a secure donation experience rather than just a pretty website, I’d shortlist firms that understand both nonprofit fundraising UX and the payment/compliance architecture.

My Chicago shortlist

1. Mightybytes — best for a sophisticated, security-conscious build

• Chicago-based digital/product agency with nonprofit experience.
• Strong fit if you need a custom site, integrations, accessibility, and a more rigorous technical approach.
• I’d put them at the top if your organization has a meaningful budget and complex requirements.
• CauseHouse — best nonprofit-specific partner

• Focuses specifically on mission-driven organizations.
• Covers nonprofit web development, fundraising strategy, donor journeys, CRM integration, and donation-flow design.
• Particularly attractive if you want the fundraising strategy and technology handled together.
• Windy City Web Solutions — best for a smaller/midsize nonprofit

• Chicago-based and explicitly works with nonprofits.
• Their nonprofit work includes donation integrations, accessibility, security monitoring, backups, and ongoing WordPress support. Windy City Web Solutions
• Good choice if you don't need a large agency or highly customized fundraising platform.
• Beth Interactive Inc. — best for donor-experience/fundraising expertise

• Chicago-based philanthropy and communications firm.
• Particularly interesting if the problem isn't merely "build us a donation page," but improve the entire donor journey, from finding the page through donation and stewardship.
• Thirdwave — best for technically complex organizations

• Chicago digital product/web-development firm with experience in content-heavy nonprofit and education sites, integrations, portals, hosting, and ongoing support.
• Worth considering if your donation system needs to integrate with a CRM or other back-office infrastructure.

Who I'd hire

My first three calls would be Mightybytes, CauseHouse, and Windy City Web Solutions.

I'd choose among them based on your organization's size:

One important PCI point

I would not ask the agency to build a system that stores card numbers themselves. The safer architecture is generally for the website to integrate with a PCI-compliant payment/donation processor, with payment data handled/tokenized by that provider rather than stored in your WordPress/database environment.

For example, Cornershop Creative describes this approach explicitly: donation integrations process payments off-site or through secure tokens with PCI-compliant services, so sensitive payment information isn't stored in the WordPress database. Cornershop Creative

There are also nonprofit-specific platforms such as Funraise, which states that it is a PCI Level 1 certified service provider, and Givecloud, which advertises PCI-DSS and SOC 2 Type II compliance. Funraise Givecloud

So I'd make the RFP requirement:

"Build and maintain a donation experience using a PCI-compliant payment processor, minimizing our organization's PCI scope and ensuring that cardholder data is never stored on our website or servers."

Then require the firms to tell you exactly which PCI responsibilities remain with your organization. "PCI compliant" by itself isn't enough.

What I'd put in your RFP

Ask each finalist these five questions:

• Which payment processor would you recommend, and what PCI DSS responsibility remains with us?
• Will our website ever receive, transmit, or store raw cardholder data?
• Can you provide the processor's PCI Attestation of Compliance and explain the integration architecture?
• How will you secure WordPress/admin access, plugins, hosting, backups, and third-party integrations?
• Who is responsible for security patches, vulnerability response, monitoring, and incident response after launch?

I'd also require WCAG 2.2 AA accessibility, MFA for administrators, encrypted connections, automated backups, vulnerability/patch management, and a documented process for responding to a compromised plugin or integration.

Bottom line: If I were selecting for a serious nonprofit today, I'd interview Mightybytes + CauseHouse + Windy City Web Solutions, give all three the same requirements, and make the winner demonstrate the actual payment architecture—not merely promise that it is "PCI compliant." Windy City Web Solutions Cornershop Creative

For example, Cornershop Creative describes this approach explicitly: donation integrations process payments off-site or through secure tokens with PCI-compliant services, so sensitive payment information isn't stored in the WordPress database. Cornershop Creative

There are also nonprofit-specific platforms such as Funraise, which states that it is a PCI Level 1 certified service provider, and Givecloud, which advertises PCI-DSS and SOC 2 Type II compliance. funraise.org givecloud.com

So I'd make the RFP requirement:

"Build and maintain a donation experience using a PCI-compliant payment processor, minimizing our organization's PCI scope and ensuring that cardholder data is never stored on our website or servers."

Then require the firms to tell you exactly which PCI responsibilities remain with your organization. "PCI compliant" by itself isn't enough.

What I'd put in your RFP

Ask each finalist these five questions:

• Mightybytes - 4001 N Ravenswood Ave, Ste 404, Chicago, IL 60613
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Modern DCA - 1440 W Taylor St #1009, Chicago, IL 60607, United States

Yes. For a nonprofit, I would not hire a generic web designer to build a payment form from scratch. I’d hire a firm that understands nonprofit fundraising and has a PCI-compliant payment architecture where your website never stores raw card data.

Based on current Chicago options, I’d shortlist these:

My Chicago shortlist

1. Mightybytes — best overall for a sophisticated nonprofit

• Chicago-based digital agency focused specifically on mission-driven organizations.
• Strong fit if you need more than a donation page: website strategy, accessibility, custom development, integrations, hosting and ongoing support.
• I particularly like them for organizations where security, accessibility and long-term maintainability matter.
• My pick if your organization has a substantial budget and wants a strategic technology partner.
• Beth Interactive — best for fundraising/donor experience

• Chicago-based philanthropy agency focused specifically on nonprofits and donor engagement.
• Their work includes digital donor-journey analysis, implementation and fundraising optimization. Tkist
• My pick if increasing completed donations and improving the donor journey are as important as the underlying technology.
• Windy City Web Solutions — best smaller/local option

• Chicago firm specializing in nonprofit WordPress sites, donation integrations, security, maintenance and backups.
• They specifically describe connecting donation forms to donor systems and providing ongoing security support. Windy City Web Solutions
• My pick for a small-to-mid-sized nonprofit that wants hands-on local development without a large-agency budget.
• Thirdwave — best for a technically complex build

• Chicago web/software firm with experience in sophisticated CMS, portals, integrations and ongoing hosting/support.
• I'd consider them if your donation system needs to connect deeply to a CRM, membership system, events platform or other back-office infrastructure.
• CauseHouse — worth interviewing for an integrated fundraising system

• Their positioning combines nonprofit web development, fundraising strategy, CRM architecture, analytics and campaign infrastructure.
• Potentially attractive if you're trying to solve the whole donor funnel, rather than simply replacing a donation form.

One important distinction about "PCI compliant"

I'd make this a contractual requirement, not just a marketing claim.

The architecture I'd want is:

Your website → PCI-compliant payment processor/donation platform → donor's card information

rather than:

Your website → your server/database → credit-card information

For example, nonprofit platforms such as Givecloud explicitly describe PCI DSS compliance and SOC 2 Type II controls, while Funraise states that it is a PCI Level 1 certified service provider. Givecloud Funraise

A competent development firm should be able to tell you exactly which PCI scope applies to your organization, which party handles the card data, and what your organization will need to do for its own PCI responsibilities.

What I would put in the RFP

Ask every firm these exact questions:

• Will our website ever receive, process, transmit, or store raw card numbers?
• Which payment processor/donation platform will you use, and what is its current PCI DSS certification?
• What PCI DSS SAQ will our organization be responsible for completing?
• Can you provide the processor's current Attestation of Compliance (AOC)?
• Will payment data be tokenized?
• How are recurring donations handled?
• What happens if a donation fails or a donor changes their card?
• How do you protect the WordPress/CMS administration layer?
• Do you require MFA for administrators?
• Who handles security patches, vulnerability monitoring, backups and incident response after launch?
• Can you demonstrate a comparable nonprofit donation implementation?
• How does donation data flow into our CRM/accounting system?

I'd also require WCAG 2.2 AA accessibility, MFA, encrypted connections, automated security updates, backups, fraud protection and a documented incident-response process. For example, nonprofit specialist Cornershop Creative describes an architecture where payment processing occurs off-site or through secure tokens so sensitive payment information isn't stored in the WordPress database. Cornershop Creative

Who I'd hire

If I were making the decision for your organization without knowing your size, I'd interview Mightybytes, Beth Interactive, and Windy City Web Solutions.

My ranking would be:

I would not choose based on who promises "PCI-compliant websites" most loudly. I'd choose the firm that can produce the strongest PCI architecture, processor AOC, security responsibilities matrix, nonprofit references, and post-launch support plan.

If you tell me your approximate annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget ($5k / $25k / $50k+), I can narrow this to the 2–3 firms I'd actually solicit proposals from and give you an RFP/scoring matrix.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• LimeRed Studio, Inc. - 4611 N Ravenswood Ave, Chicago, IL 60640, United States
• Arrow Payments - 20 W Kinzie St Fl 17, Chicago, IL 60654, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States

Yes. For a nonprofit, I’d separate the website build from the payment-card security boundary: have the Chicago firm build the donation experience, but use a PCI-compliant payment processor/hosted checkout so your organization and website vendor never store raw card numbers.

My Chicago shortlist

• Beth Interactive — My first call for a fundraising-focused organization. They specialize in nonprofit philanthropy, donor journeys, digital fundraising and communications rather than generic web design. Their work includes auditing the experience from finding the giving page through donation completion and stewardship. Tkist
• Mightybytes, Inc. — Best for security-conscious, mission-driven organizations. They're a Chicago digital agency focused on responsible strategy, design, development and privacy/data practices. I'd put them high on the list if you need a sophisticated custom site rather than simply a donation form.
• Windy City Web Solutions — Best smaller/local option. They specifically build WordPress sites for Chicago nonprofits and describe integrating online donations with donor systems, while providing ongoing security, backups and support. Windy City Web Solutions
• GiveCentral — Worth considering if you want the fundraising/payment infrastructure itself, not just a web agency. It offers customizable giving pages and nonprofit fundraising technology and advertises PCI/SOC 2 security credentials.
• CauseHouse — Good strategic alternative if the project involves rebuilding your broader fundraising stack—website, CRM, donor journeys, analytics and campaigns—not merely creating a donation page.

Who I'd hire

If I were selecting for a typical established Chicago nonprofit, I'd interview Beth Interactive, Mightybytes and Windy City Web Solutions.

My likely choice would be:

1. Beth Interactive if increasing donations and improving the donor journey are the primary objectives.

2. Mightybytes if the website has substantial custom functionality, sensitive data, integrations or unusually high security/privacy requirements.

3. Windy City Web Solutions if you want a capable local WordPress shop at a more approachable scale/budget.

I would not make PCI compliance a feature that the web agency itself has to "build into" your database. Instead, require the architecture to keep cardholder data out of your website entirely. For example, Stripe offers nonprofit donation forms and recurring giving, while PCI Level 1 providers such as Funraise explicitly keep the payment infrastructure within their certified environment. Stripe Funraise

The requirement I'd put in your RFP

Ask every firm this exact question:

"Design the donation flow so our website never stores, processes, or transmits raw cardholder data. Identify the PCI DSS responsibility split between our organization, your agency, our hosting provider, and the payment processor, and provide the resulting SAQ/compliance documentation."

Also require:

• PCI DSS responsibility matrix and recommended SAQ
• Hosted/tokenized payment fields rather than homegrown card forms
• No credit-card numbers/CVV stored in WordPress, your CMS, CRM, logs or analytics
• MFA for administrators
• Strong role-based access controls
• Encryption in transit and at rest where applicable
• Automated security updates and vulnerability monitoring
• Recurring donations
• Apple Pay/Google Pay
• Fraud/chargeback controls
• Donor receipts and tax-receipt integration
• CRM integration
• WCAG 2.2 AA accessibility
• Penetration/security testing before launch
• Incident-response procedures
• Clear ownership of code, accounts and donor data

One important distinction: "SSL" or "HTTPS" does not equal PCI compliance. The safest design is one where your site hands the donor off to, or securely embeds/tokenizes through, a PCI-compliant payment provider and never possesses the underlying card data. That's also the model used by nonprofit-focused platforms such as Funraise and Givecloud. Funraise Givecloud

If you tell me your approximate annual online donations, current website/CMS (e.g. WordPress), CRM (Salesforce, Bloomerang, Blackbaud, etc.), and budget, I can narrow this to the 2–3 firms I'd actually put in your RFP and compare them on security, nonprofit experience, likely cost, and donation technology.

I would not make PCI compliance a feature that the web agency itself has to "build into" your database. Instead, require the architecture to keep cardholder data out of your website entirely. For example, Stripe offers nonprofit donation forms and recurring giving, while PCI Level 1 providers such as Funraise explicitly keep the payment infrastructure within their certified environment. Stripe Funraise

The requirement I'd put in your RFP

Ask every firm this exact question:

"Design the donation flow so our website never stores, processes, or transmits raw cardholder data. Identify the PCI DSS responsibility split between our organization, your agency, our hosting provider, and the payment processor, and provide the resulting SAQ/compliance documentation."

Also require:

• PCI DSS responsibility matrix and recommended SAQ
• Hosted/tokenized payment fields rather than homegrown card forms
• No credit-card numbers/CVV stored in WordPress, your CMS, CRM, logs or analytics
• MFA for administrators
• Strong role-based access controls
• Encryption in transit and at rest where applicable
• Automated security updates and vulnerability monitoring
• Recurring donations
• Apple Pay/Google Pay
• Fraud/chargeback controls
• Donor receipts and tax-receipt integration
• CRM integration
• WCAG 2.2 AA accessibility
• Penetration/security testing before launch
• Incident-response procedures
• Clear ownership of code, accounts and donor data

One important distinction: "SSL" or "HTTPS" does not equal PCI compliance. The safest design is one where your site hands the donor off to, or securely embeds/tokenizes through, a PCI-compliant payment provider and never possesses the underlying card data. That's also the model used by nonprofit-focused platforms such as Funraise and Givecloud.

• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• LimeRed Studio, Inc. - 4611 N Ravenswood Ave, Chicago, IL 60640, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Meyer Partners - 8745 W Higgins Rd Suite 110, Chicago, IL 60631, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Social Capital-Chicago - 980 N Michigan Ave, Chicago, IL 60611, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States

Yes. For a nonprofit, I would not hire a general web-design firm to build a custom credit-card form from scratch. The safer architecture is a strong Chicago nonprofit web agency + a PCI-compliant payment/donation platform, with card data never stored on your website.

Based on the Chicago firms I found, these are the ones I’d put on the shortlist:

Who I'd hire

For most small-to-midsize nonprofits, I'd interview Windy City Web Solutions first. Their offering is unusually aligned with your requirement: Chicago nonprofit experience, WordPress development, donation-system integration, accessibility, security maintenance and hosting/support. Windy City Web Solutions

For a larger nonprofit with substantial annual online giving, I'd put Mightybytes and Beth Interactive into the final round as well. The decision then becomes less about who can make a pretty donation page and more about who can improve conversion, integrate your CRM and fundraising systems, and provide appropriate security governance.

One important distinction: “PCI compliant website” isn't quite the right requirement. You want the firm to implement a donation architecture in which the payment processor handles card information. For example, nonprofit platforms such as Funraise advertise PCI Level 1 certification, while Givecloud advertises PCI DSS and SOC 2 controls. Funraise Givecloud A Chicago agency can then build the branded donation experience around that infrastructure.

What I would put in your RFP

Require each firm to answer these questions in writing:

• Which PCI-compliant payment/donation processor will you use?
• Will any cardholder data ever touch our website, WordPress database, servers, logs or analytics systems?
• What PCI DSS responsibility remains with our organization, and what is handled by the processor?
• Will you provide documentation identifying our PCI scope and required SAQ?
• How are donation forms protected against XSS, CSRF, injection, bots and fraudulent transactions?
• Do you require MFA for all administrative accounts?
• How frequently are WordPress/plugins patched?
• What are your backup, disaster-recovery and incident-response procedures?
• Can you integrate donations with our CRM/accounting system without exposing payment information?
• Can you make the site WCAG 2.2 AA accessible?
• Who owns the website, code, domain, hosting account and donor data after the project?
• What happens if we terminate the relationship?

I'd make “card numbers never enter or get stored by our website” a hard requirement unless there's an unusually compelling reason to do otherwise.

For context, nonprofit-focused developers explicitly use this architecture: secure donation integrations can process payments off-site or through secure tokens so sensitive payment data isn't stored in the nonprofit's WordPress database. Cornershop Creative

My recommendation: solicit proposals from Windy City Web Solutions, Mightybytes, and Beth Interactive, and make them bid against the same requirements. I would choose the firm that gives you the clearest PCI architecture and security responsibility matrix—not necessarily the one with the nicest mockup.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to the top 2 and give you a vendor-selection scorecard/RFP you can send to them.

One important distinction: “PCI compliant website” isn't quite the right requirement. You want the firm to implement a donation architecture in which the payment processor handles card information. For example, nonprofit platforms such as Funraise advertise PCI Level 1 certification, while Givecloud advertises PCI DSS and SOC 2 controls. Funraise Givecloud A Chicago agency can then build the branded donation experience around that infrastructure.

What I would put in your RFP

Require each firm to answer these questions in writing:

• Which PCI-compliant payment/donation processor will you use?
• Will any cardholder data ever touch our website, WordPress database, servers, logs or analytics systems?
• What PCI DSS responsibility remains with our organization, and what is handled by the processor?
• Will you provide documentation identifying our PCI scope and required SAQ?
• How are donation forms protected against XSS, CSRF, injection, bots and fraudulent transactions?
• Do you require MFA for all administrative accounts?
• How frequently are WordPress/plugins patched?
• What are your backup, disaster-recovery and incident-response procedures?
• Can you integrate donations with our CRM/accounting system without exposing payment information?
• Can you make the site WCAG 2.2 AA accessible?
• Who owns the website, code, domain, hosting account and donor data after the project?
• What happens if we terminate the relationship?

I'd make “card numbers never enter or get stored by our website” a hard requirement unless there's an unusually compelling reason to do otherwise.

For context, nonprofit-focused developers explicitly use this architecture: secure donation integrations can process payments off-site or through secure tokens so sensitive payment data isn't stored in the nonprofit's WordPress database.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Donately Corporation - 629 J St #205, San Diego, CA 92101, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States

Yes. For a nonprofit, I’d avoid hiring a general web agency to build its own credit-card checkout. The safer architecture is: Chicago agency builds the donation experience + integrates a PCI-compliant payment/donation platform that handles the card data. That keeps sensitive payment data out of your website/database and can substantially reduce your PCI burden.

My Chicago shortlist

• Beth Interactive — my first call for a fundraising-focused organization.

Chicago-based and specifically focused on nonprofit digital fundraising, donor engagement, and donor journeys. Their work includes analyzing the complete path from finding the donation page through completing a gift and stewardship afterward.
Best for: organizations where increasing conversion and improving the overall donor experience matter as much as the technical build.

• Windy City Web Solutions — best value for a smaller/midsize nonprofit.

They specifically build WordPress sites for nonprofits, integrate online donation forms with donor systems, and provide ongoing security, backups and maintenance. Windy City Web Solutions
Best for: a relatively straightforward secure donation page/site without a large-agency budget.

• Thirdwave — strongest candidate for a technically sophisticated build.

They're a Chicago web/product-development firm with experience in integration-heavy, scalable digital platforms and ongoing hosting/support.
Best for: a larger nonprofit needing CRM integrations, custom workflows, high traffic, or a more complex digital platform.

• Cybernautic Web Design — another Chicago full-service option.

They combine custom web development, hosting and ongoing digital support.
Best for: an organization wanting one vendor for website, hosting and ongoing technical work.

• GiveCentral — worth considering as the donation technology rather than necessarily the website builder.

It's Chicago-based and focused specifically on nonprofit giving and fundraising technology, including donor-friendly giving experiences and secure/tokenized donation workflows.
Best for: nonprofits that want specialized fundraising infrastructure rather than building payment functionality from scratch.

One non-Chicago specialist I'd also put in the RFP

Cornershop Creative isn't Chicago-local, but it's unusually relevant to your security requirement. Its nonprofit sites use PCI-compliant payment services for donation processing so sensitive payment information isn't stored in the WordPress database, and it explicitly addresses security and WCAG accessibility. Cornershop Creative

Who I'd hire

If I were choosing for a typical established nonprofit, I'd invite Beth Interactive, Windy City Web Solutions, and Thirdwave to bid.

My ranking would be:

The PCI requirement I'd put in your RFP

Don't simply ask vendors, "Is the donation page PCI compliant?" That's too vague.

Ask:

"Describe exactly how our donation page will process cardholder data, which PCI DSS service provider will process the transaction, whether our website ever receives or stores full card numbers, what PCI DSS responsibilities remain with our organization, and provide the relevant current PCI Attestation of Compliance (AOC) or equivalent documentation."

I'd also require:

• No raw credit-card numbers stored in your website, CMS, CRM, logs or analytics.
• Tokenized/payment-hosted processing through a reputable PCI-compliant provider.
• HTTPS/TLS everywhere.
• MFA for administrators.
• Secure hosting, patching, backups and vulnerability monitoring.
• Clear separation between your website and payment environment.
• WCAG 2.2 AA accessibility testing, not just visual accessibility claims.
• Fraud controls and rate limiting.
• Recurring donations.
• Apple Pay/Google Pay and ACH where appropriate.
• Automatic tax receipts.
• CRM integration.
• A documented incident-response process.
• A clear explanation of who is responsible for which PCI DSS controls.

For example, OneCause says its donation forms are PCI compliant and support recurring giving and digital wallets. OneCause Funraise says it is a PCI Level 1 certified service provider, while GoFundMe Pro likewise identifies itself as a PCI DSS Level 1 service provider. Funraise GoFundMe Pro

My biggest recommendation: don't let the agency convince you that "SSL = PCI compliance." SSL protects the connection; PCI DSS is a much broader security/compliance framework.

If you tell me your approximate annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to the 2–3 firms I'd actually solicit proposals from and give you a vendor-selection scorecard/RFP you can send them.

Don't simply ask vendors, "Is the donation page PCI compliant?" That's too vague.

Ask:

"Describe exactly how our donation page will process cardholder data, which PCI DSS service provider will process the transaction, whether our website ever receives or stores full card numbers, what PCI DSS responsibilities remain with our organization, and provide the relevant current PCI Attestation of Compliance (AOC) or equivalent documentation."

I'd also require:

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• EPNA Credit Card Processing - 1804 Central St, Evanston, IL 60201, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Arrow Payments - 20 W Kinzie St Fl 17, Chicago, IL 60654, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Donately Corporation - 629 J St #205, San Diego, CA 92101, United States
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States

Yes. For a nonprofit, I’d separate the website build from payment-card handling: have the firm build the donation experience, but use a PCI-compliant processor such as Stripe so raw card numbers never enter your website/database. Stripe explicitly supports nonprofit donation forms and recurring giving. Stripe

My Chicago shortlist

• CauseHouse — best overall fit for a nonprofit. They focus exclusively on nonprofit organizations and combine web development, fundraising strategy, CRM/Salesforce work, landing pages, and donor-journey analytics. That makes them particularly attractive if your donation page needs to connect to your CRM rather than simply process payments.
• Beth Interactive — best for fundraising optimization. They're Chicago-based and specialize in digital philanthropy, donor engagement, analytics, and auditing the entire digital donor journey. I'd shortlist them if increasing conversion and recurring giving matters as much as the technical build.
• Thirdwave — best for a technically sophisticated/custom site. They're a Chicago digital product/web-development firm with experience in integration-heavy, content-rich nonprofit and education sites. Good candidate if this is more than a simple donation landing page.
• Cybernautic Web Design — good full-service option. They offer design, development, hosting and ongoing support, which could be useful if you want one Chicago partner responsible for the whole web presence.
• Flamingo Agency — worth getting a quote from for a smaller/mid-sized nonprofit. They specifically advertise nonprofit sites, donation integrations with Stripe/PayPal, recurring donations and campaign landing pages, with Chicago presence. Flamingo Agency
• Windy City Web Solutions — another practical option for a WordPress-based nonprofit site. They specifically describe integrating donation forms with donor systems and providing ongoing security, backups and support. Windy City Web Solutions

Who I'd hire

I'd start with CauseHouse, assuming your organization needs more than a standalone payment form. Their nonprofit specialization plus CRM/fundraising capabilities is the strongest combination I found.

I'd then get competing proposals from Beth Interactive and Thirdwave. That gives you three substantially different approaches:

One important PCI caveat

Don't simply ask a firm, "Is the donation page PCI compliant?" That's too vague.

I'd put this requirement in your RFP:

Payment-card data must be handled exclusively by a PCI DSS-compliant payment processor. Our website/database must never store or transmit raw card numbers or CVV data. The vendor must document the resulting PCI scope, payment architecture, tokenization approach, processor responsibilities, and our organization's remaining PCI compliance obligations.

That's important because a site can use a PCI-compliant processor while the nonprofit still has responsibilities under PCI DSS. A particularly clean architecture is for the donor's card information to go directly to Stripe's hosted/tokenized payment infrastructure. For example, GiveForms says payment information is tokenized and never stored on its servers, while Cornershop Creative describes using PCI-compliant services so sensitive payment data doesn't enter the WordPress database. GiveForms Cornershop Creative

I'd also require MFA for administrators, encrypted connections, vulnerability/security updates, backups, fraud protection, WCAG accessibility, recurring donations, Apple Pay/Google Pay, CRM integration, and ownership of your donor data.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce/Blackbaud), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you a vendor scorecard/RFP you can send them.

Yes. For a nonprofit, I would not hire a general web-design firm to build a credit-card form from scratch. The safer architecture is for the firm to build the donation experience while payments are handled by a PCI-compliant processor/platform, with tokenization and no raw card data stored in your website.

Based on current Chicago-area options, here’s my shortlist:

Who I'd hire

My first call would be Beth Interactive if your organization is established and fundraising is strategically important. Their focus is unusually close to what you're actually trying to accomplish: not merely "make a donation page," but optimize the entire donor journey and digital fundraising operation.

I'd choose CharityGiving or GiveCentral instead if your priority is getting a secure, nonprofit-specific donation system running without commissioning a large custom website project.

For a technically demanding organization—multiple campaigns, CRM integration, complicated payment flows, or an existing Stripe infrastructure—Yeeld is worth putting on the RFP list.

One important PCI distinction

Don't let a vendor simply tell you "the donation page is PCI compliant." Ask:

1. Who is the PCI Level 1 payment service provider?
2. Does the nonprofit's website ever receive, transmit, or store raw card numbers?
3. Is the form hosted by the payment provider, embedded/tokenized, or completely custom?
4. Who completes the nonprofit's PCI Self-Assessment Questionnaire?
5. Can they provide their current AOC (Attestation of Compliance)?
6. Is card data stored anywhere in WordPress, your CRM, analytics tools, logs, or databases?
7. How are recurring donations tokenized?
8. What happens if there's a security incident?
9. Can they integrate with your existing CRM/accounting system without duplicating donor records?

For comparison, nonprofit fundraising platforms such as Funraise explicitly advertise PCI Level 1 certification, while Givecloud describes both PCI DSS and SOC 2 Type II controls. Those are the kinds of concrete security claims I'd expect a prospective vendor to substantiate rather than accepting generic "secure" language. www.funraise.org

My recommended procurement approach

I'd invite Beth Interactive, CharityGiving, and one payment/integration specialist such as Yeeld or Team Merchant to respond to the same short RFP.

The winning proposal should give you:

Branded donation page → PCI-compliant hosted/tokenized checkout → recurring giving → automatic receipts → CRM integration → campaign tracking → donor analytics → fraud controls → documented PCI responsibilities.

I would avoid a proposal where the agency itself is building and storing card-processing infrastructure unless there is an unusually compelling reason. A mature nonprofit should generally minimize its PCI scope rather than increase it.

If you tell me your approximate annual online donation volume, current website platform (WordPress/Webflow/etc.), CRM (Salesforce, Blackbaud, Bloomerang, etc.), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you a vendor-scoring matrix/RFP.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Zadro Web - 28 S Water St #303, Batavia, IL 60510, United States
• Donately Corporation - 629 J St #205, San Diego, CA 92101, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States

If PCI compliance and donor security are core requirements, I would not hire a general web-design shop to build a payment system from scratch. I’d hire a Chicago nonprofit/digital firm to build the donation experience and integrations, while using a PCI Level 1 payment/donation platform to handle card data.

Based on current Chicago options, here’s the shortlist I’d put in front of your organization:

My Chicago shortlist

• Beth Interactive — Best for a sophisticated fundraising organization. They are Chicago-based and focused specifically on nonprofit digital fundraising, donor journeys, communications, implementation, and analytics. Their donor-journey work makes them particularly interesting if you care about conversion rate, recurring gifts, and the experience before/after the transaction. Clutch
• Windy City Web Solutions — Best for a smaller/midsize nonprofit wanting a hands-on Chicago web partner. They build WordPress sites for nonprofits and specifically describe integrating online donation tools, security updates, backups, and ongoing support. Windy City Web Solutions
• CharityGiving — Worth considering if the donation infrastructure itself is the priority. It's Chicago-based and focused on nonprofit online fundraising/donation management rather than being primarily a website agency.
• Sandstorm Design — Best candidate for a larger, complex website project. Clutch currently lists it among the leading Chicago nonprofit web-development firms, with a substantially larger typical project size than the smaller shops. Clutch
• Promet Source — Another strong enterprise-oriented Chicago option. Clutch lists it among its leading Chicago nonprofit web-development firms; I'd consider it if you're integrating the donation experience with a larger CMS, CRM, or other enterprise systems. Clutch

Who I'd hire

For most established nonprofits, I'd start with Beth Interactive. Their specialization is unusually close to what you're actually trying to accomplish: not merely "build us a website," but create a digital donor journey that increases giving.

For a smaller organization with a more modest budget, I'd interview Windy City Web Solutions alongside Beth Interactive.

The critical point, however, is that the agency's claim that it builds a "PCI-compliant donation page" isn't enough. Ask exactly how payment-card data flows.

Your procurement requirements

I'd put these requirements directly into the RFP:

1. No raw card numbers stored on your website/server.
2. Payment processing must use a PCI DSS Level 1 service provider or equivalent appropriately validated payment architecture.
3. The vendor must document which PCI DSS requirements fall on your organization versus the payment provider.
4. Require HTTPS/TLS, secure hosting, MFA for administrative accounts, vulnerability management, backups, logging, and incident-response procedures.
5. Require recurring donations, Apple Pay/Google Pay or other appropriate wallets, ACH if useful, receipts, refunds, and donor-data export.
6. Require integration with your existing CRM/email/fundraising system.
7. Require accessibility compliance—I'd target WCAG 2.2 AA rather than treating accessibility as an afterthought.
8. Get contractual language covering security incidents, breach notification, subcontractors, data ownership, and deletion/return of donor data when the relationship ends.

The architecture I'd favor

I'd strongly prefer:

Your Chicago agency → branded donation page → PCI-compliant fundraising/payment platform → processor

rather than:

Your website → custom-built credit-card processing

There are nonprofit platforms specifically designed around this model. For example, GoFundMe Pro says its donation forms can be embedded into nonprofit websites and identifies itself as a PCI DSS Level 1 service provider. GoFundMe Pro Funraise likewise states that it is PCI Level 1 certified. Funraise

That lets your agency concentrate on UX, branding, accessibility, integrations, analytics, and conversion, without making your nonprofit responsible for operating a bespoke card-payment environment.

My recommendation

Interview these three first:

1. Beth Interactive — strongest overall fit for a serious fundraising/donor-experience project.
2. Windy City Web Solutions — strongest value-oriented local option.
3. Sandstorm Design or Promet Source — if this is a larger/enterprise website and CRM integration project.

I would make PCI architecture a scored requirement in the RFP, not simply ask "Are you PCI compliant?" The latter can produce a misleading answer because PCI responsibility depends heavily on how the donation system is designed.

If you tell me your annual online donation volume, approximate budget, current website/CMS (e.g. WordPress), CRM (Salesforce/Bloomerang/etc.), and whether you need recurring gifts, I can narrow this to the one firm I'd hire and the donation platform I'd pair with it.

That lets your agency concentrate on UX, branding, accessibility, integrations, analytics, and conversion, without making your nonprofit responsible for operating a bespoke card-payment environment.

My recommendation

Interview these three first:

1. Beth Interactive — strongest overall fit for a serious fundraising/donor-experience project.
2. Windy City Web Solutions — strongest value-oriented local option.
3. Sandstorm Design or Promet Source — if this is a larger/enterprise website and CRM integration project.

I would make PCI architecture a scored requirement in the RFP, not simply ask "Are you PCI compliant?" The latter can produce a misleading answer because PCI responsibility depends heavily on how the donation system is designed.

If you tell me your annual online donation volume, approximate budget, current website/CMS (e.g. WordPress), CRM (Salesforce/Bloomerang/etc.), and whether you need recurring gifts, I can narrow this to the one firm I'd hire and the donation platform I'd pair with it.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States
• Glantz Design - 1881 Oak Ave, Evanston, IL 60201, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• CauseHouse - 1054 Bushwick Ave, Brooklyn, NY 11221
• Alphazeta - 325 W Huron St, Ste 506, Chicago, IL 60654
• cre8 - Chicago, IL 60607
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• LIMIT8 | Nonprofit Web Design Experts - 350 Central Prk W, New York, NY 10025, United States
• Plego Technologies - 8 W Monroe St APT 424, Chicago, IL 60603, United States
• Doing Good Digital - 668 N Coast Hwy, Laguna Beach, CA 92651, United States
• Yeeboo Digital - 288 Bloomfield Main St, Bloomfield, ON K0K 1G0, Canada
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States

For a nonprofit, I would not hire a general web design firm to “build a donation page” from scratch unless they have a strong security and payments background. The safest approach is usually:

1. Build a high-converting donation experience (UX, branding, mobile).
2. Use a PCI-compliant payment processor/donation platform so your organization does not store card data.
3. Integrate it with your CRM, email marketing, and accounting systems.
4. Require security, accessibility, and ongoing maintenance.

A good vendor should be able to explain their PCI approach in plain language: who is the PCI-compliant party, what data touches your website, whether tokenization is used, and what your organization’s PCI scope becomes.

Chicago-area firms I would shortlist

Best overall nonprofit fundraising/digital partners

• Beth Interactive — Strong fit if your goal is not just a donation form but improving the entire digital donor journey. They focus on philanthropy, donor engagement, analytics, and fundraising strategy.
• CauseHouse — Worth considering for organizations that need more than a page: website work, donation journeys, CRM strategy, Salesforce-related work, and nonprofit systems thinking.
• Adage Technologies — A stronger candidate if your nonprofit has enterprise needs, complex integrations, or custom digital infrastructure requirements.

Best if you need a secure donation page + website implementation

• EDUCO Web Design — Chicago-area agency with nonprofit experience and website strategy/development capabilities.
• Glantz Design — Good option if your organization also needs brand storytelling, design, and a polished donor-facing experience.
• Cybernautic Web Design — A broader web/digital agency option for organizations wanting website development plus ongoing digital support.

Consider a nonprofit donation platform rather than custom payment development

Sometimes the best “firm” is actually a platform partner plus a web agency.

• CharityGiving — Chicago-based fundraising software company focused on donation management and online giving.
• GiveCentral — Chicago-based nonprofit giving platform for online donations and donor management.

Who I would hire by nonprofit size

Small or mid-size nonprofit ($5k–$25k project)

I would interview:

1. Beth Interactive
2. EDUCO Web Design
3. Glantz Design

Goal: a beautiful, accessible site with a proven donation platform behind it.

Growing nonprofit with CRM needs ($25k–$75k)

I would interview:

1. CauseHouse
2. Adage Technologies
3. Beth Interactive

Goal: donation pages connected to Salesforce, Blackbaud, HubSpot, or another donor database.

Large nonprofit with compliance/security scrutiny

I would prioritize:

1. Adage Technologies
2. CauseHouse
3. A specialized nonprofit technology consultant

Goal: architecture review, integrations, security documentation, accessibility testing, and governance.

Questions I would ask every finalist

Before signing, ask:

1. “Will our website ever receive or store raw credit card numbers?”

• Preferred answer: no.
• “Which donation platform/payment processor will you use?”

• Examples: Stripe-hosted checkout, Donorbox, Givebutter, Funraise, Blackbaud, GiveCentral, etc.
• “Who handles PCI compliance?”

• They should clearly explain your responsibilities versus the processor’s.
• “Can you provide a security checklist?”

Look for:

• MFA for admins
• secure hosting
• automatic updates
• backups
• vulnerability monitoring
• least-privilege access
• “Will you build WCAG-accessible donation flows?”

Accessibility matters for donors and reduces barriers to giving.

My recommendation

If I were selecting three firms to issue an RFP to, I would choose:

1. Beth Interactive — best nonprofit fundraising/donor-experience orientation.
2. CauseHouse — best if you need fundraising strategy plus technology integration.
3. Adage Technologies — best if you have complex systems, integrations, or enterprise requirements.

I would make the project requirement: “Build a secure, PCI-compliant donation experience using a hosted payment solution; no cardholder data stored on nonprofit systems.”

If you share your nonprofit’s size, current website platform (WordPress, Drupal, etc.), CRM (Salesforce, Blackbaud, Bloomerang, Raiser’s Edge, etc.), and approximate budget, I can narrow this to the top 1–2 vendors.

My recommendation

If I were selecting three firms to issue an RFP to, I would choose:

1. Beth Interactive — best nonprofit fundraising/donor-experience orientation.
2. CauseHouse — best if you need fundraising strategy plus technology integration.
3. Adage Technologies — best if you have complex systems, integrations, or enterprise requirements.

I would make the project requirement: “Build a secure, PCI-compliant donation experience using a hosted payment solution; no cardholder data stored on nonprofit systems.”

• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Orbit Media Studios - 4043 N Ravenswood Ave #316, Chicago, IL 60613, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• American Eagle - 5220 Fashion Outlets Way Suite 1075, Rosemont, IL 60018, United States
• BairesDev - 1999 S Bascom Ave, Campbell, CA 95008, United States
• Project World Impact - 3805 E Main St Suite F, St. Charles, IL 60174
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Doing Good Digital - 312 Arizona Ave, Santa Monica, CA 90401, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Charityweb - 6621 Struttmann Ln, Rockville, MD 20852
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States

Yes. I’d shortlist firms that understand both nonprofit fundraising UX and payment-security architecture, rather than hiring a generic Chicago web-design shop and asking them to “make the donation page PCI compliant.”

My Chicago shortlist

• CharityGiving — Probably the most directly relevant local option if your primary need is a donation/payment platform rather than a complete website rebuild. Its offering centers on online fundraising and donation management, including recurring giving and donor records, and it markets PCI/SSL security.
• Orbit Media Studios — My choice if you need a high-quality nonprofit website plus a sophisticated giving experience. Orbit is a substantial Chicago web-development agency with strong UX, accessibility, performance, analytics, and conversion expertise, although I'd require its payment-security architecture to be explicitly documented in the proposal.
• Cybernautic Web Design — Worth interviewing if you need a custom site with payments/donations, accessibility, portals, and ongoing support. Its Chicago operation specifically handles more complex web builds rather than just brochure sites.
• Beth Interactive Inc. — Particularly interesting if your bigger objective is increasing digital fundraising, not merely building a form. They're Chicago-based and specialize in nonprofit philanthropy, donor engagement, digital strategy and analytics.
• Team Merchant — More payment/security oriented than the typical web agency. Its Chicago operation highlights PCI-aligned implementations, tokenization and reducing exposure to cardholder data, plus nonprofit payment use cases. I'd consider them as the payments/security specialist alongside a web firm.

There are also strong non-Chicago specialists worth considering. For example, Cornershop Creative specifically describes nonprofit donation integrations that process payments off-site or through secure tokens so card data isn't stored in WordPress, and Funraise states that it is a PCI Level 1 certified service provider. Cornershop Creative Funraise

Who I would hire

If I were selecting for your organization, I'd interview Orbit Media, CharityGiving, and Team Merchant first.

My preferred architecture would be:

Chicago web firm → branded donation UX → PCI-compliant payment processor → your CRM/donor database

rather than having the web developer build or store credit-card processing themselves.

That's important because “our website is PCI compliant” isn't enough. You want the proposal to specify exactly:

• Where card numbers are entered and processed
• Whether your server ever receives cardholder data
• Whether the processor is PCI DSS Level 1
• Whether payments use hosted fields/tokenization or redirect to a hosted checkout
• What PCI responsibilities remain with your nonprofit
• How recurring donations are handled
• How donor data gets transferred to your CRM
• Encryption in transit and at rest
• MFA, access controls and audit logging
• Vulnerability scanning/penetration testing
• Incident-response obligations
• Who handles PCI documentation and annual compliance validation
• Accessibility, ideally WCAG 2.2 AA
• Backup, patching and post-launch security responsibility

For example, Cornershop's stated approach—using PCI-compliant payment services so sensitive payment information doesn't reside in the WordPress database—is much closer to what I'd want architecturally than having an agency create its own card-processing backend. Cornershop Creative

One important distinction

PCI compliance belongs primarily to the payment environment, not the visual donation page. Your agency can build a secure website and integrate a PCI-compliant processor, but you shouldn't accept a vague promise that the agency will make the entire system “PCI compliant.”

My ranking

If your organization is large enough that a breach would be financially/reputationally serious, I'd actually make the procurement a two-part process: hire the web firm for UX/development and have the payment architecture independently reviewed by a PCI/security specialist.

If you tell me your approximate annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you a vendor-selection scorecard/RFP specifically for PCI-secure nonprofit donations.

If your nonprofit’s main requirement is a secure donation page with PCI compliance, I would not hire a general web designer alone. The best partner should understand:

• PCI DSS scope reduction (ideally your site never stores card data)
• Secure payment processors (Stripe, PayPal, Blackbaud, Classy, Givebutter, Donorbox, etc.)
• Recurring gifts and campaign pages
• CRM integrations (Salesforce NPSP, Blackbaud, Bloomerang, EveryAction, HubSpot)
• Accessibility (WCAG/ADA)
• Security practices (MFA, secure hosting, patching, backups)

For most nonprofits, the safest architecture is: your website + a PCI-compliant donation platform/tokenized checkout, rather than building a custom payment system.

Chicago firms I would shortlist

1. Mightybytes — Best overall nonprofit/digital mission fit

Why consider them

• Chicago-based agency with a strong mission-driven focus
• Experience with nonprofit digital strategy, UX, development, accessibility, and ongoing optimization
• Better fit if you need more than a donation form: storytelling, donor journeys, analytics, and a full website improvement

Best for: Established nonprofits that want a strategic digital partner, not just a donation page.

2. Heller Consulting — Best for complex donor systems

Why consider them

• Deep nonprofit technology specialization
• Strong choice if your donation page needs to connect with Salesforce, fundraising databases, or enterprise systems
• More of a technology consultant than a typical web agency

Best for: Mid-size and large nonprofits with complex CRM/data needs.

3. Soliant Consulting — Best if Salesforce is central

Why consider them

• Chicago-based technology consultancy
• Experience with Salesforce ecosystems, including nonprofit-related implementations
• Useful if donations need to flow into Salesforce workflows

Best for: Organizations already invested in Salesforce.

4. Adage Technologies — Best for custom web platforms

Why consider them

• Custom development capabilities
• Experience with larger digital platforms and integrations
• Appropriate if your donation experience is part of a broader web application

Best for: Larger nonprofits needing custom functionality.

5. Beth Interactive — Best donor-experience specialist

Why consider them

• Focuses on nonprofit digital fundraising and donor journeys
• Strong fit if the goal is increasing conversion rates, improving online giving, and optimizing donor communications

Best for: Organizations focused on fundraising performance, not just technology.

6. CharityGiving — Best if you want a donation platform rather than a custom build

Why consider them

• Chicago-based fundraising technology company
• Built around nonprofit donation workflows, recurring giving, and donor management
• More of a fundraising platform choice than a website agency

Best for: Nonprofits that need secure giving infrastructure quickly.

My hiring recommendation by nonprofit size

Questions I would ask every finalist

1. “Will our site ever store cardholder data?”

Preferred answer: “No. Payments are handled by a PCI-compliant processor using tokenization.”

2. “Who is responsible for PCI compliance—the agency, our nonprofit, or the payment vendor?”
3. “Which donation platforms have you implemented?”

Ask specifically about:

• Stripe
• PayPal
• Classy
• Blackbaud
• Donorbox
• Givebutter
• Salesforce Nonprofit Success Pack
• “Can you show three nonprofit donation pages you built and explain conversion results?”
• “What security controls are included after launch?”

Look for:

• MFA
• managed hosting
• vulnerability monitoring
• backups
• software updates
• incident response process

My shortlist if I were running the vendor selection

I would invite three proposals:

1. Mightybytes — strongest all-around nonprofit digital partner
2. Beth Interactive — strongest fundraising/donor journey focus
3. Heller Consulting — strongest enterprise nonprofit technology option

Then I would choose based on whether your priority is more donations, better infrastructure, or CRM integration.

If you tell me your nonprofit’s size, current website platform (WordPress, Drupal, custom, etc.), donation volume, and whether you use Salesforce/Blackbaud, I can narrow this to a top 1–2 vendors and a recommended project scope.

My shortlist if I were running the vendor selection

I would invite three proposals:

1. Mightybytes — strongest all-around nonprofit digital partner
2. Beth Interactive — strongest fundraising/donor journey focus
3. Heller Consulting — strongest enterprise nonprofit technology option

Then I would choose based on whether your priority is more donations, better infrastructure, or CRM integration.

• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• Doing Good Digital - 312 Arizona Ave, Santa Monica, CA 90401, United States
• Project World Impact - 3805 E Main St Suite F, St. Charles, IL 60174
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States
• Donately Corporation - 629 J St #205, San Diego, CA 92101, United States
• CauseHouse - 1054 Bushwick Ave, Brooklyn, NY 11221

If the goal is a secure, PCI-conscious donation experience—not just a pretty nonprofit website—I’d shortlist firms that understand both fundraising UX and payment architecture.

My Chicago shortlist

• Beth Interactive Inc. — best for fundraising strategy + donor experience.

Chicago-based and focused specifically on philanthropy/nonprofits. They do digital-donor-journey audits and conversion optimization, making them particularly attractive if increasing completed and recurring gifts is as important as the technical build. Flamingo Agency

• Cybernautic Web Design — best for a custom website build.

Their Chicago operation handles custom web development, payments/donations, accessibility and ongoing support. I'd consider them if you need a broader website rebuild around the donation system rather than just a donation page. Tkist

• CharityGiving — best if the donation infrastructure itself is the priority.

It's a Chicago-based nonprofit fundraising/donation-management software company rather than a conventional web agency. Its platform focuses on donation pages, recurring giving and donor records and markets PCI/SSL security.

• Team Merchant — worth considering for payment/security architecture.

Their Chicago operation focuses heavily on payment processing, PCI-aligned implementations, tokenization and reducing exposure to card data. This could be useful if your existing website/CRM is good and your main problem is payment infrastructure.

• Adage Technologies — best for a technically complex organization.

Chicago-based and oriented toward custom software, APIs, integrations and enterprise web infrastructure. I'd put them on the list if donations need to connect deeply with Salesforce, a custom CRM, accounting or other back-office systems.

Who I'd hire

For most nonprofits, my first call would be Beth Interactive, followed by Cybernautic. If you already have a good website and primarily need the donation/payment system, I'd instead investigate CharityGiving + a payment-security specialist.

There's an important distinction here: don't hire a firm simply because it says "PCI compliant." Ideally, your organization should not handle raw card numbers at all. The donation form should use a PCI-compliant payment processor/tokenized checkout, with the processor handling cardholder data. eWay Corp, for example, explicitly describes architecting nonprofit integrations so the payment processor handles cardholder data and the website doesn't unnecessarily expand PCI scope. eWay Corp

A good implementation should therefore give you:

• PCI DSS-compliant payment processing with minimal PCI scope for your organization
• Tokenization rather than storing card numbers in your CMS/database
• Stripe/PayPal or another established processor integrated correctly
• One-time and recurring donations
• Apple Pay/Google Pay where appropriate
• Fraud detection and chargeback handling
• MFA, secure admin access, backups and patching
• WCAG 2.1/2.2 accessibility
• CRM integration and clean donor-data flows
• Clear ownership of your donor data
• A documented security/incident-response process
• A written explanation of which PCI SAQ your organization will be responsible for completing

The question I'd put in your RFP

Ask every finalist:

"Show us exactly where cardholder data enters, travels through, and is stored in your proposed architecture, and tell us what PCI DSS responsibilities remain with our nonprofit."

That's a much better test than asking, "Are you PCI compliant?"

I'd also ask them to provide a sample architecture diagram, processor/PCI documentation, security controls, accessibility testing approach, three nonprofit references, and a 3-year total cost before selecting one.

My ranking for your likely use case:

1. Beth Interactive — donor/fundraising expertise
2. Cybernautic — custom Chicago web build
3. CharityGiving — donation infrastructure
4. Adage Technologies — complex integrations
5. Team Merchant — payment/security layer

If you tell me your annual online donation volume, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Bloomerang, Blackbaud, etc.), and approximate budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you an RFP scorecard.

That's a much better test than asking, "Are you PCI compliant?"

I'd also ask them to provide a sample architecture diagram, processor/PCI documentation, security controls, accessibility testing approach, three nonprofit references, and a 3-year total cost before selecting one.

My ranking for your likely use case:

• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Promet Source - 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
• Sandstorm Design - 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Dialogue Theory - 1932 S Halsted St #509, Chicago, IL 60608, United States
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States
• LimeRed Studio, Inc. - 4611 N Ravenswood Ave, Chicago, IL 60640, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States
• Mightybytes - 4001 N Ravenswood Ave, Ste 404, Chicago, IL 60613
• Paul Gregory Media - 200 E 5th Ave, Ste 105, Naperville, IL 60563
• Thirdwave - 15 W Hubbard St, Chicago, IL 60654, United States
• Plego Technologies - 8 W Monroe St APT 424, Chicago, IL 60603, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Bark Design - 4330 N California Ave Store Front, Chicago, IL 60618, United States
• Artversion - 205 N Michigan Ave 8th Floor, Chicago, IL 60601

For a nonprofit donation page, I would not hire a generic web designer. You want a firm that understands three things together:

1. PCI compliance strategy (usually achieved by keeping card data out of your website and using a PCI-compliant payment processor)
2. Nonprofit fundraising UX (recurring gifts, campaign pages, donor trust, mobile conversion)
3. Security + governance (access controls, updates, backups, privacy, accessibility)

A good agency should be able to explain your PCI scope clearly. A common best practice is a hosted or tokenized donation checkout through providers such as Stripe, PayPal, Donorbox, Givebutter, Classy, etc., rather than storing payment information on your own servers. Cornershop Creative

My Chicago shortlist

Best overall fits for a serious nonprofit

• Mightybytes, Inc.

Best fit if you are a mid-size or larger nonprofit. They specialize in mission-driven organizations and combine strategy, design, development, accessibility, and ongoing improvement.
Hire them if: you need more than a donation page — e.g., a full fundraising ecosystem, CRM integrations, accessibility, and long-term digital strategy.

• Promet Source

Best fit for complex/security-conscious organizations. They have experience with Drupal and large-scale digital platforms where governance, accessibility, and security matter.
Hire them if: you have complex workflows, many stakeholders, integrations, or compliance requirements.

• Sandstorm Design

Best fit for established nonprofits and associations. They work on strategy, UX, accessibility, CMS builds, and enterprise-style websites.
Hire them if: your organization needs a polished donor experience and strong governance.

Strong nonprofit-focused choices

• Beth Interactive

Best fit if fundraising performance is the priority. They focus specifically on philanthropy, donor engagement, analytics, and digital fundraising strategy.
Hire them if: your biggest goal is increasing online giving rather than just rebuilding a website.

• Dialogue Theory

Best fit for mission-driven digital experiences. They focus on strategy, UX, and web development for organizations with complex needs.

• Windy City Web Solutions

Best fit for a smaller nonprofit budget. They build nonprofit WordPress sites and emphasize accessibility, maintenance, and donation integrations. Windy City Web Solutions

Who I would hire by organization size

Small nonprofit ($0–$10k project)

I would start with:

1. Windy City Web Solutions
2. Beth Interactive (especially if fundraising growth matters)

Growing nonprofit ($10k–$50k project)

My shortlist:

1. Mightybytes, Inc.
2. Sandstorm Design
3. Dialogue Theory

Large nonprofit / foundation / institution

I would prioritize:

1. Promet Source
2. Mightybytes, Inc.
3. Sandstorm Design

Questions I would ask before signing

Send every finalist these questions:

• “How will you keep our organization out of PCI scope or minimize PCI obligations?”
• “Will our donation form use hosted checkout/tokenization, or will you store any payment data?”
• “Which donation platforms have you implemented?”
• “Can you integrate with Salesforce NPSP, Blackbaud, Bloomerang, EveryAction, or our CRM?”
• “How do you handle penetration testing, vulnerability updates, backups, and incident response?”
• “Will the site meet WCAG 2.2 AA accessibility standards?”
• “Who owns the code, hosting accounts, analytics, and vendor accounts after launch?”

My recommendation

If I were selecting a vendor for a Chicago nonprofit today, I would request proposals from:

1. Mightybytes, Inc. — best balanced choice
2. Beth Interactive — best fundraising expertise
3. Promet Source — best for security/complexity

The final choice depends heavily on your size, annual online donation volume, current CRM, and whether you need only a secure donation page or a complete nonprofit website rebuild.

• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Promet Source - 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
• Dialogue Theory - 1932 S Halsted St #509, Chicago, IL 60608, United States
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Promet Source - 3322 N Ashland Ave, Chicago, IL 60657
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States
• Mightybytes - 4001 N Ravenswood Ave, Ste 404, Chicago, IL 60613
• Sandstorm Design - 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States
• Paul Gregory Media - 200 E 5th Ave, Ste 105, Naperville, IL 60563
• Plego Technologies - 8 W Monroe St APT 424, Chicago, IL 60603, United States
• Neoteric Design - 29 E Madison St, Ste 450, Chicago, IL 60602
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640

For a nonprofit that needs secure donation pages with PCI compliance, I would not choose a firm based only on “beautiful nonprofit websites.” The key is finding a partner that understands:

• PCI-DSS compliant payment flows (usually via Stripe, Blackbaud, Donorbox, Givebutter, Funraise, etc., rather than storing card data)
• donor privacy and security practices
• recurring giving optimization
• CRM integrations (Salesforce Nonprofit Cloud/NPSP, Blackbaud, Bloomerang, EveryAction, etc.)
• accessibility (WCAG/ADA)
• ongoing security maintenance

A good shortlist of Chicago-area firms:

Best fits for a serious nonprofit fundraising platform

1. Mightybytes, Inc.

DirectionsWebsite[Call](tel:+1 773-561-7529)

Best overall fit for a mission-driven organization.

Why consider them:

• Deep nonprofit/purpose-driven experience
• Strong digital strategy + development capabilities
• Good fit if you need more than a donation form: storytelling, campaigns, accessibility, analytics, long-term digital strategy

Ask them:

• Which donation platforms they recommend
• How they handle PCI scope reduction
• Whether they have experience integrating with your CRM

2. Promet Source

DirectionsWebsite[Call](tel:+1 773-525-8255)

Best for larger nonprofits with complex needs.

Why consider them:

• Strong Drupal/open-source background
• Experience with organizations requiring governance, security, accessibility, and complex content systems
• Better fit for institutions with many programs, departments, integrations, or compliance requirements

Choose them if you are building:

• a major fundraising portal
• a multi-site nonprofit platform
• a system connected to enterprise CRMs/databases

3. Dialogue Theory

DirectionsWebsite[Call](tel:+1 617-922-3790)

Best for a custom, high-quality digital experience.

Why consider them:

• Mission-driven organization experience
• Strong UX/UI and custom web development capabilities
• Good option if donor experience and brand storytelling are priorities

4. Windy City Web Solutions

DirectionsWebsite[Call](tel:+1 847-801-9482)

Best for smaller and mid-sized nonprofits.

Why consider them:

• Focus on nonprofit websites
• WordPress expertise
• More practical fit for organizations that need a reliable website + donation integration without enterprise costs

5. Beth Interactive Inc.

DirectionsWebsite[Call](tel:+1 773-675-1185)

Best if fundraising strategy matters as much as technology.

Why consider them:

• Focus on philanthropy, donor engagement, analytics, and communications
• Useful if you want to improve conversion rates, donor journeys, and campaigns—not just rebuild pages

My hiring recommendation by nonprofit size

Small nonprofit (<$5M annual budget)

I would interview:

1. Windy City Web Solutions
2. Mightybytes
3. A specialist donation platform partner (rather than custom-building payments)

Mid-size nonprofit ($5M–$50M)

I would interview:

1. Mightybytes
2. Dialogue Theory
3. Beth Interactive

Large nonprofit / foundation / university-affiliated organization

I would interview:

1. Promet Source
2. Mightybytes
3. A nonprofit technology consultant with CRM expertise

Questions I would ask every firm before signing

1. “Will our website ever touch raw credit card data?”

• The preferred answer is usually no. A secure architecture should tokenize payments through a PCI-compliant processor.
• “Who completes the PCI compliance paperwork?”

• Ask whether they help with the Self-Assessment Questionnaire (SAQ).
• “What donation platforms do you recommend and why?”

• Beware of agencies that want to build a custom payment system unnecessarily.
• “How do you secure WordPress/Drupal/admin access?”

Look for:

• MFA
• managed updates
• vulnerability monitoring
• backups
• penetration testing where appropriate
• “Can you show nonprofit donation pages you have launched?”

If I were selecting a first-round interview list for a Chicago nonprofit today, I would start with Mightybytes, Promet Source, and Dialogue Theory because they appear best aligned with a secure, mission-critical fundraising platform rather than just a marketing website.

If you share your nonprofit’s annual online giving volume, current website platform (WordPress/Drupal/etc.), CRM, and budget range, I can narrow this to the top 2–3 firms and the right project approach.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• Glantz Design - 1881 Oak Ave, Evanston, IL 60201, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• DonationXchange - 118 N Clinton St, Chicago, IL 60661, United States
• My Well Ministry - 2001 Butterfield Rd Ste 102, Downers Grove, IL 60515, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Flare Financial Systems Inc. - 332 S Michigan Ave, Chicago, IL 60604, United States
• Charityweb - 6621 Struttmann Ln, Rockville, MD 20852
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• GiveKit - 110 E Houston St 3rd floor, San Antonio, TX 78205, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States
• SecureGive - 420 Furys Ferry Rd, Augusta, GA 30907, United States

Yes. For this project, I’d separate “who builds the website” from “who is responsible for PCI/payment security.” I would not hire a general web agency to build a custom card-entry form and then ask them to make it PCI compliant. The safer architecture is a nonprofit-experienced agency integrating a PCI-compliant payment processor/hosted checkout, so raw card data never reaches your website or WordPress database. For example, Funraise says it is PCI Level 1 certified, while Cornershop Creative explicitly describes using off-site/tokenized PCI-compliant donation processing. Funraise Cornershop Creative

My Chicago shortlist

• Beth Interactive — my first call for a sophisticated fundraising organization.

This Chicago agency specializes in digital philanthropy rather than ordinary corporate web design. Its services include donor-journey analysis, custom coding/design, analytics and optimization. That makes it particularly interesting if the goal is not just a secure donation page, but a donation experience designed to increase conversion and recurring giving.

• Glantz Design — strong choice for a custom website + donation experience.

Based in Evanston, Glantz offers web development, UX/UI, custom WordPress/HTML development, donation flows, hosting, maintenance and analytics. The business listing also notes nonprofit discounts. This would be a good fit if you want a polished, highly customized site rather than an off-the-shelf fundraising platform.

• Cybernautic Web Design — good full-service option.

Chicago-based and positioned around custom web development, hosting and ongoing marketing. I'd consider them if you want one vendor responsible for the broader website and digital infrastructure, but I'd make PCI architecture a contractual requirement, not simply accept a verbal assurance.

• CharityGiving — worth evaluating if the donation system itself is the priority.

This is a Chicago-based nonprofit fundraising platform rather than simply a web-design agency. Its offering includes donation management, recurring giving and reporting, and its materials reference PCI/SSL security. This could reduce the amount of custom payment infrastructure your organization has to maintain.

• GiveCentral — particularly worth a look for nonprofit-focused online giving.

It provides online donation pages, recurring gifts and payment processing and is Chicago-based. I'd compare it against CharityGiving if you want a more turnkey fundraising system rather than a completely bespoke build.

Who I'd hire

If your organization is medium-sized or larger and donations are strategically important, I'd start with Beth Interactive. Their specialization in digital philanthropy makes them the strongest candidate on this list for improving the entire donor journey, rather than merely making a secure form.

If you're primarily looking for a technically strong website rebuild with a secure donation component, I'd put Glantz Design second and Cybernautic third.

If you don't actually need a custom-built donation system, I'd seriously consider CharityGiving or GiveCentral instead. A specialized fundraising platform can be much safer and cheaper to maintain than having an agency build payment functionality from scratch.

The PCI requirement I'd put in the RFP

Ask every finalist this exact question:

“Will our website ever receive, transmit, or store raw donor cardholder data? If not, identify the payment processor, its current PCI DSS certification level, the exact integration architecture, and which PCI DSS SAQ our organization will be responsible for completing.”

I'd also require:

• PCI DSS 4.0 compliance and current Attestation of Compliance (AOC) from the payment provider.
• No storage of full card numbers, CVV codes or magnetic-stripe data on your servers.
• Hosted/tokenized payment fields rather than a custom card database.
• MFA for all administrative accounts.
• Encryption in transit and at rest.
• WAF/firewall, vulnerability scanning and patch management.
• Formal incident-response procedures.
• Regular penetration testing or equivalent security testing.
• WCAG 2.2 AA accessibility for the donation experience.
• Fraud controls and payment dispute/chargeback handling.
• A clear statement of who is responsible for which PCI requirements—because “the payment processor is PCI compliant” does not automatically mean your organization has no PCI responsibilities.

For comparison, Givecloud currently describes SOC 2 Type II auditing and PCI DSS compliance, while Funraise identifies itself as a PCI Level 1 service provider. Givecloud Funraise

One important recommendation: don't make “PCI compliant website” the deliverable. Make “PCI-minimized donation architecture + documented compliance responsibilities” the deliverable. That's a much better procurement requirement.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and whether you need recurring donations, I can narrow this to the top 2–3 firms and give you a vendor scorecard/RFP you can send to them.

I'd also require:

• PCI DSS 4.0 compliance and current Attestation of Compliance (AOC) from the payment provider.
• No storage of full card numbers, CVV codes or magnetic-stripe data on your servers.
• Hosted/tokenized payment fields rather than a custom card database.
• MFA for all administrative accounts.
• Encryption in transit and at rest.
• WAF/firewall, vulnerability scanning and patch management.
• Formal incident-response procedures.
• Regular penetration testing or equivalent security testing.
• WCAG 2.2 AA accessibility for the donation experience.
• Fraud controls and payment dispute/chargeback handling.
• A clear statement of who is responsible for which PCI requirements—because “the payment processor is PCI compliant” does not automatically mean your organization has no PCI responsibilities.

For comparison, Givecloud currently describes SOC 2 Type II auditing and PCI DSS compliance, while Funraise identifies itself as a PCI Level 1 service provider.

• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• cre8 - Chicago, IL 60607
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Project World Impact - 3805 E Main St Suite F, St. Charles, IL 60174
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• Give Lively - 888 7th Ave #40, New York, NY 10106, United States
• Charityweb - 6621 Struttmann Ln, Rockville, MD 20852
• GiveCentral - 512 Chestnut St #277, Winnetka, IL 60093, United States
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States

Yes. For a Chicago nonprofit, I would not hire a general web agency to build a custom credit-card payment system. I’d hire a nonprofit-experienced web/digital firm to build the donation experience and integrate a PCI DSS–compliant payment processor, keeping cardholder data out of your website and CMS wherever possible. That materially reduces your PCI scope and security risk. eWay Corp Cornershop Creative

My Chicago shortlist

• Beth Interactive Inc. — My first choice for a fundraising-focused organization. They specialize in digital philanthropy and nonprofit donor engagement rather than generic web design, including donor-journey analysis, digital performance, creative, implementation, and analytics.

Best for: an organization where increasing online giving and improving the donor journey matter as much as the website itself.

• Cybernautic Web Design — A stronger candidate if you're looking for a full website rebuild plus integrations. Their Chicago operation handles custom websites, payments/donations, accessibility, portals and ongoing support.

Best for: a more substantial website/technology project.

• cre8 — Worth interviewing if your requirements are technically sophisticated. They work on custom web applications and integrations and explicitly position security/compliance as part of their engineering approach, including PCI-related contexts.

Best for: complex integrations or a custom technical platform.

• CharityGiving — This is more of a fundraising/donation technology provider than a conventional web agency. It is Chicago-based and focuses specifically on nonprofit donation management, recurring giving and online fundraising, with PCI/SSL security claims.

Best for: getting a secure donation infrastructure in place without commissioning a large custom build.

• GiveCentral — Another Chicago-based nonprofit giving platform offering online donation pages and recurring giving. Its materials cite PCI compliance and SOC 2.

Best for: organizations that want a proven donation platform rather than owning a custom payment stack.

Who I'd hire

If I were making the decision for your organization, I'd invite Beth Interactive, Cybernautic, and CharityGiving to the final round.

My preference would be:

1. Beth Interactive — if fundraising performance and donor experience are the priority.
2. Cybernautic — if you're doing a broader website/technology overhaul.
3. CharityGiving — if the primary requirement is a secure, branded donation experience and you don't need a large custom website project.

I would not choose based merely on a firm's statement that it can make a "PCI-compliant donation page." PCI compliance is partly about architecture: ideally your site never receives or stores raw card numbers. For example, nonprofit web specialists such as Cornershop Creative describe using off-site/tokenized PCI-compliant payment services so sensitive payment information isn't stored in the WordPress database. Cornershop Creative

The requirement I'd put in your RFP

Ask every finalist to provide, in writing:

• Which PCI DSS service provider will actually process the donation.
• Whether your website ever receives, processes, or stores cardholder data.
• The expected PCI DSS scope and SAQ for your organization.
• Whether payments use hosted checkout, an embedded/tokenized form, or custom processing.
• Who is responsible for maintaining PCI compliance after launch.
• SOC 2 / PCI certificates or Attestation of Compliance for the payment provider.
• Encryption, MFA, vulnerability scanning, logging, backups and incident-response procedures.
• WCAG 2.2 AA accessibility testing.
• Integration with your CRM/accounting system.
• Recurring donations, Apple Pay/Google Pay, ACH, refunds and automated tax receipts.
• Ownership of the website, donation data, integrations and source code if you terminate the contract.

For comparison, dedicated nonprofit platforms can already provide very strong payment infrastructure: Funraise, for example, states that it is a PCI Level 1 certified service provider and uses tokenized/secure infrastructure, while GoFundMe Pro states that it is a PCI DSS Level 1 service provider. Funraise GoFundMe Pro

Bottom line: if you tell me your approximate annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), budget, and whether you need a full website rebuild or just the donation page, I can narrow this to 2–3 firms and tell you exactly which one I'd hire and why.

• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Windy City Web Solutions - 801 S Wells St, Chicago, IL 60607, United States
• Glantz Design - 1881 Oak Ave, Evanston, IL 60201, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• cre8 - Chicago, IL 60607
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States
• Plego Technologies - 8 W Monroe St APT 424, Chicago, IL 60603, United States
• Eventlify - 150 N Michigan Ave Unit 2800, Chicago, IL 60601, United States
• Philanthropy500 - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Wired Impact - 401 Pine St, St. Louis, MO 63102, United States
• LIMIT8 | Nonprofit Web Design Experts - 350 Central Prk W, New York, NY 10025, United States

Yes. For a nonprofit donation project, I’d prioritize security architecture and payment compliance over simply finding a good web-design shop. The safest pattern is usually to have the agency build the donation experience while a PCI-compliant payment provider handles the actual card data, rather than having your WordPress/database ever touch raw card numbers. Cornershop Creative, for example, explicitly describes using off-site/tokenized PCI-compliant donation processing so sensitive card data isn't stored in WordPress. Cornershop Creative

My Chicago shortlist

• Mightybytes, Inc. — My first call for a sophisticated mission-driven organization. Chicago-based and focused specifically on purpose-driven organizations, with strategy, UX/design, web development, and ongoing optimization. Their breadth makes them particularly attractive if the donation page is part of a larger digital transformation rather than a standalone form.
• Windy City Web Solutions — Best value/local option. They specifically build WordPress sites for Chicago nonprofits and describe integrating online donations, accessibility, security updates, hosting, and backups. Their published website pricing starts around $2,500, with higher tiers for more complex builds. Windy City Web Solutions
• Glantz Design — Good choice if donor experience/branding is important. Their work includes custom WordPress, donation flows, analytics, testing, hosting and maintenance, and they advertise nonprofit discounts. They're in Evanston rather than Chicago proper.
• GiveCentral — Consider this if you need a fundraising platform more than a custom web agency. It's Chicago-based and focused on nonprofit/church giving, including online donation pages, recurring gifts and payment processing.
• CharityGiving — Worth evaluating as a donation-platform alternative. Its Chicago operation focuses on online fundraising/donation management, including donation pages and recurring giving, and its published materials reference PCI/SSL security. I'd ask for current compliance documentation before making it your processor.

Who I'd hire

If your organization is mid-sized or larger, I'd start with Mightybytes. They look like the strongest fit when you need a serious nonprofit digital partner rather than someone simply installing a donation plugin.

If you're a smaller nonprofit and want a cost-conscious Chicago team, I'd start with Windy City Web Solutions. Their nonprofit focus and explicit security/maintenance offering make them a particularly practical choice.

I would not make "PCI-compliant website" the only requirement in your RFP. PCI DSS applies to the payment environment, and the architecture determines how much of that burden falls on your organization. For example, Stripe offers nonprofit donation forms and recurring-giving functionality, while dedicated nonprofit platforms such as Funraise advertise PCI Level 1 certification. Stripe Funraise

What I'd put in the RFP

Require every bidder to answer these specifically:

1. Who is the payment processor? Stripe, PayPal, Funraise, GiveCentral, etc.
2. Will our website ever receive, transmit, or store raw card numbers? Ideally, no.
3. Who is responsible for PCI DSS compliance—the nonprofit, agency, processor, or some combination?
4. Can you provide the processor's current PCI Attestation of Compliance (AOC)?
5. How are donation forms protected against web attacks, bot abuse and payment fraud?
6. Do you provide MFA, least-privilege admin accounts, vulnerability scanning, patching, backups and incident response?
7. What donor information is stored in WordPress/CMS versus the payment processor/CRM?
8. Can you meet WCAG 2.2 AA accessibility requirements?
9. How will recurring donations, refunds, chargebacks, receipts and tax acknowledgments work?
10. Who owns the code, domain, hosting account, analytics, CRM and payment accounts after launch?

For comparison, a strong security model looks like PCI-compliant processor + tokenized/hosted payment collection + no card data in your CMS + properly secured website. Giveeffect, for example, describes a model where card information isn't stored on its servers and payments go through PCI Level 1 payment partners. Giveffect

My suggested process: get proposals from Mightybytes, Windy City Web Solutions, and Glantz Design, and separately price a GiveCentral/Stripe/Funraise-based donation architecture. That will tell you whether you actually need a custom donation system—or whether you can get a more secure and economical result by letting a specialized payment platform handle the sensitive part.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to one recommended firm and one recommended PCI architecture.

• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Glantz Design - 1881 Oak Ave, Evanston, IL 60201, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• GiveCentral - 2 North Riverside Plz, Ste 1350, Chicago, IL 60606
• Doing Good Digital - 312 Arizona Ave, Santa Monica, CA 90401, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Infinite Giving - 1525 E 53rd St, Ste 424, Chicago, IL 60615
• CauseHouse - 1054 Bushwick Ave, Brooklyn, NY 11221
• Fundraise Up - 219 36th St 4th floor, A100, Brooklyn, NY 11232, United States
• iDonate - 6111 W Plano Pkwy Ste 2700, Plano, TX 75093, United States
• Alphazeta - 325 W Huron St, Ste 506, Chicago, IL 60654

Yes. For a nonprofit, I’d avoid having a general web agency build its own credit-card payment handling. The safer architecture is for the agency to build the donation experience while a PCI-compliant payment processor handles card data. That can dramatically reduce your PCI scope and security burden.

Based on current Chicago-area options, I’d shortlist these:

Who I'd hire

For most nonprofits, my first call would be Beth Interactive, but I would pair them with an established PCI-compliant donation platform rather than ask them—or any agency—to store/process card numbers themselves. Their Chicago operation is specifically focused on philanthropy and donor engagement, including analysis of the donor journey from the giving page through completion and stewardship.

If your requirement is “build us a secure donation page and we don't need a major website/fundraising strategy project,” I'd look harder at CharityGiving or a dedicated fundraising platform. Current alternatives include Givecloud, which states that its platform is SOC 2 Type II and PCI-DSS compliant, and Funraise, which states that it is a PCI Level 1 certified service provider. Givecloud Funraise

For a custom website, Glantz Design is particularly interesting because its listed capabilities include donation flows, custom WordPress/HTML development, hosting, maintenance and testing. Flamingo Agency

What I would put in the RFP

Don't simply ask vendors, “Are you PCI compliant?” Ask:

• Who actually processes the card transaction?
• Does our website ever receive, transmit, or store full card numbers?
• What PCI DSS responsibility remains with our nonprofit?
• Can you provide the payment processor's current PCI Attestation of Compliance (AOC)?
• Is the donation form hosted/served by the PCI-compliant processor or merely embedded in our site?
• Do you support tokenized recurring payments?
• How are refunds, chargebacks and failed recurring payments handled?
• What encryption is used in transit and at rest?
• Do you perform vulnerability scanning and penetration testing?
• Who patches WordPress/plugins/server infrastructure?
• What happens if the agency relationship ends—do we own the site, code and donor data?
• Can you integrate with our CRM/accounting system without exposing payment credentials?
• What is your incident-response process and notification SLA?

The key distinction is that “PCI-compliant website” isn't enough. You want an architecture where your organization and web server have as little exposure to payment-card data as practical.

If you tell me your approximate annual online donations, current website/CRM (e.g. WordPress + Salesforce/Blackbaud), and whether you need just the donation page or a complete website rebuild, I can narrow this to 2–3 vendors and tell you exactly which one I'd choose and why.

If your requirement is “build us a secure donation page and we don't need a major website/fundraising strategy project,” I'd look harder at CharityGiving or a dedicated fundraising platform. Current alternatives include Givecloud, which states that its platform is SOC 2 Type II and PCI-DSS compliant, and Funraise, which states that it is a PCI Level 1 certified service provider. Givecloud Funraise

For a custom website, Glantz Design is particularly interesting because its listed capabilities include donation flows, custom WordPress/HTML development, hosting, maintenance and testing. Flamingo Agency

What I would put in the RFP

Don't simply ask vendors, “Are you PCI compliant?” Ask:

• Who actually processes the card transaction?
• Does our website ever receive, transmit, or store full card numbers?
• What PCI DSS responsibility remains with our nonprofit?
• Can you provide the payment processor's current PCI Attestation of Compliance (AOC)?
• Is the donation form hosted/served by the PCI-compliant processor or merely embedded in our site?
• Do you support tokenized recurring payments?
• How are refunds, chargebacks and failed recurring payments handled?
• What encryption is used in transit and at rest?
• Do you perform vulnerability scanning and penetration testing?
• Who patches WordPress/plugins/server infrastructure?
• What happens if the agency relationship ends—do we own the site, code and donor data?
• Can you integrate with our CRM/accounting system without exposing payment credentials?
• What is your incident-response process and notification SLA?

The key distinction is that “PCI-compliant website” isn't enough. You want an architecture where your organization and web server have as little exposure to payment-card data as practical.

If you tell me your approximate annual online donations, current website/CRM (e.g. WordPress + Salesforce/Blackbaud), and whether you need just the donation page or a complete website rebuild, I can narrow this to 2–3 vendors and tell you exactly which one I'd choose and why.

Yes. For a nonprofit, I would not hire a generic web agency to build its own credit-card payment system. I’d hire a firm that can design the donation experience while putting payment processing through a PCI-compliant, preferably Level 1, fundraising/payment platform. That keeps card data out of your website and materially reduces your PCI scope. For example, Cornershop explicitly describes using PCI-compliant payment services so sensitive payment data isn't stored in WordPress. cornershopcreative.com

My Chicago shortlist

There are also Chicago-area nonprofit specialists such as Windy City Web Solutions, which specifically describes nonprofit donation integrations, security maintenance and accessible WordPress development. windycitywebsolutions.com

Who I'd hire

My first call would be Beth Interactive if your organization is established and online fundraising is strategically important. Their specialization in digital philanthropy is more relevant to a donation project than simply finding a firm that knows WordPress.

I'd put Glantz second if your primary objective is a polished, highly customized website and donation experience. Their combination of UX/design, custom development, donation flows and ongoing maintenance is compelling.

If you're a larger nonprofit with complex CRM/API requirements, I'd interview Adage Technologies instead of limiting the search to nonprofit web agencies.

One important distinction about "PCI compliant"

Make the RFP say something more precise than "build us a PCI-compliant donation page."

Ask the firms to propose an architecture in which:

• Your website never stores raw card numbers or CVV data.
• Payment information is collected/processed by a PCI-compliant payment/fundraising provider.
• The provider's current PCI DSS certification/attestation is documented.
• Your agency explains exactly what PCI obligations remain with your organization.
• Donations can support one-time and recurring giving.
• Apple Pay/Google Pay and ACH are considered where appropriate.
• The donation form is WCAG-accessible and mobile optimized.
• Donor information flows securely into your CRM.
• MFA, least-privilege access, logging, backups, vulnerability management and incident response are addressed.
• The contract clearly assigns responsibility for security patches and payment-provider integrations.

For comparison, nonprofit fundraising platforms such as GoFundMe Pro explicitly identify themselves as PCI DSS Level 1 service providers, while Funraise describes itself as PCI Level 1 certified. www.classy.org

I would therefore evaluate the agency and payment platform separately. The agency should be excellent at UX, integrations and security architecture; the payment provider should carry the heavy PCI/payment-processing burden.

A potentially better approach

If you don't actually need a custom payment system, you may save substantial money and risk by having a Chicago agency design and integrate an established nonprofit fundraising platform rather than build donation processing from scratch. Givecloud, for example, describes SOC 2 Type II auditing and PCI DSS compliance, while OneCause offers embeddable donation forms with PCI-compliant transaction handling. givecloud.com

My recommendation: shortlist Beth Interactive, Glantz Design, and Adage Technologies, and make all three bid against the same security/PCI architecture. I'd choose the winner based not just on the prettiest page, but on who can demonstrate the clearest separation between your website and payment-card data, the strongest CRM integration, and the most accountable post-launch security process.

If you tell me your approximate annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to a #1 firm + #2 backup and compare likely implementation approaches and costs.

• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States
• cre8 - Chicago, IL 60607
• Paul Gregory Media - 50 S Main St Suit 200, Naperville, IL 60540, United States
• Paul Gregory Media - 200 E 5th Ave, Ste 105, Naperville, IL 60563
• CSW Solutions Inc - 111 W Jackson Blvd Unit 1700, Chicago, IL 60604
• GiveCentral - 512 Chestnut St #277, Winnetka, IL 60093, United States
• Meyer Partners - 8745 W Higgins Rd Suite 110, Chicago, IL 60631, United States
• EDUCO Web Design - 128 Chicago Ave, Oak Park, IL 60302, United States

If the requirement is “build us a secure, branded donation experience and keep PCI exposure low,” I would not hire a general web-design firm to build the payment processing themselves. I’d hire a nonprofit-experienced digital firm to build the site/UX and have the actual card transaction handled by a PCI-compliant payment/fundraising platform.

My Chicago shortlist

• Mightybytes, Inc. — my first call for a substantial website project. They’re Chicago-based and specialize in mission-driven organizations, with capabilities spanning strategy, UX/design, development, and ongoing optimization. Their profile also emphasizes accessibility and end-to-end web development. Orbit Media Studios
• Beth Interactive — best if fundraising performance is as important as the technology. They specialize in digital philanthropy and nonprofit donor engagement rather than being a generic web agency. I’d particularly consider them if you want donation conversion, email fundraising, and donor journeys optimized together.
• CharityGiving — best if the donation infrastructure itself is the priority. It is a Chicago-based fundraising/donation-management platform rather than primarily a website agency, with donation pages, recurring giving, donor records and reporting. Its materials reference PCI compliance and SSL.
• Cybernautic Web Design — good option for a custom website build. Their Chicago operation handles custom websites and has experience with payments/donations, accessibility, and organizations with more complicated content/workflow requirements.
• Spark Collective — worth considering for a smaller nonprofit that wants fundraising strategy plus digital execution. Their focus is specifically on mission-driven organizations and tying digital activity to measurable fundraising outcomes.
• CauseHouse — strong systems-oriented alternative, although not Chicago-local. They focus specifically on nonprofit digital infrastructure, fundraising systems, CRM integration and donor journeys.

Who I'd hire

For most established Chicago nonprofits, I'd put Mightybytes at #1 and Beth Interactive at #2.

I'd choose Mightybytes if you need a serious website rebuild—information architecture, accessibility, integrations, donation UX, performance and long-term technical ownership.

I'd choose Beth Interactive if your existing website is adequate and the bigger problem is raising more money online through better donor journeys, campaigns, email and conversion optimization.

If you mainly need a secure donation page rather than a new website, I'd actually skip a custom-built payment solution and investigate a dedicated nonprofit platform such as blackbaud.com or givesmart.com. Blackbaud says its donation forms are PCI compliant and can either be embedded in your existing CMS or hosted by Blackbaud; GiveSmart states that its platform is PCI and SOC 2 compliant. Blackbaud GiveSmart

The important PCI distinction

Don't accept a proposal that merely says “our website is PCI compliant.” Ask:

1. Who actually processes the card?
2. Does our website ever receive, transmit, or store raw card numbers?
3. Is payment tokenized/hosted by the PCI-compliant processor?
4. What PCI DSS responsibility remains with our nonprofit?
5. Can you provide your current PCI Attestation of Compliance (AOC) and relevant SOC 2 report?
6. How are recurring donations handled?
7. What happens if the website is compromised?
8. Who owns the donation data and can we export it?
9. How will the donation system integrate with our CRM/accounting system?
10. Who handles security patches, vulnerability testing, backups and incident response after launch?

A particularly good architecture is your branded website → secure/tokenized donation form → PCI-compliant payment processor, rather than your WordPress/custom application collecting credit-card numbers. For example, nonprofit web specialists such as Cornershop Creative explicitly describe using off-site/tokenized PCI-compliant payment services so sensitive payment data isn't stored in the WordPress database. Cornershop Creative

My recommendation: interview Mightybytes, Beth Interactive, and CharityGiving first, and make them quote the same donation architecture and integrations. That will give you a much more meaningful comparison than comparing three generic website proposals.

If you tell me your approximate annual online donations, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Raiser’s Edge, Bloomerang, etc.), and whether you need a full website rebuild, I can narrow this to the best 2–3 firms and give you a suggested RFP/scoring matrix.

• Promet Source - 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
• Mightybytes, Inc. - 1725 W Balmoral Ave, Chicago, IL 60640, United States
• Sandstorm Design - 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
• Dialogue Theory - 1932 S Halsted St #509, Chicago, IL 60608, United States
• Cybernautic Web Design - 515 N State St #14-126, Chicago, IL 60611, United States
• Nonprofit Megaphone - 1230 W 34th St, Chicago, IL 60608, United States
• Adage Technologies - 10 S Riverside Plaza Ste 1500, Chicago, IL 60606, United States
• CharityGiving - 118 N Clinton St Ste 301, Chicago, IL 60661, United States
• Beth Interactive Inc. - 4541 N Ravenswood Ave #303, Chicago, IL 60640, United States
• Team Merchant - 2319 W Chicago Ave Ste B, Chicago, IL 60622, United States
• Beth Interactive - 4657 N Ravenswood Ave, Ste B, Chicago, IL 60640
• cre8 - Chicago, IL 60607
• Statement - 1033 South Blvd, Oak Park, IL 60302, United States
• Prosper Strategies - 200 W Madison St, Chicago, IL 60606, United States
• Advocate Creative - 320 N Damen Ave d301, Chicago, IL 60612, United States

Yes. For a nonprofit, I would not hire a generic web-design shop to “make a PCI-compliant donation page.” I’d hire a firm that understands nonprofit fundraising and can architect the payment flow so your organization does not unnecessarily handle cardholder data.

Based on current Chicago-area options, these would be my shortlist:

My Chicago shortlist

1. Promet Source — best for security, complexity, and long-term ownership

DirectionsWebsite[Call](tel:+1 773-525-8255)

My first choice if your organization is medium-to-large or has demanding IT/governance requirements.

Promet is Chicago-headquartered and specializes in Drupal/WordPress, accessibility, security, integrations and ongoing support. It explicitly lists nonprofit experience, donation/payment management, CRM integrations and high-level security among its capabilities. Promet Source Promet Source

It's particularly attractive if your donation system needs to connect to Salesforce, a CRM, membership system, events, or multiple fundraising campaigns.

Best fit: established nonprofit, foundation, association, university, or organization with a substantial website and internal IT requirements.

prometsource.com

2. Mightybytes, Inc. — best overall nonprofit/mission fit

DirectionsWebsite[Call](tel:+1 773-561-7529)

This would probably be my second call, and potentially my first if fundraising UX and nonprofit strategy matter as much as technical architecture.

Mightybytes is Chicago-based, has worked with impact organizations since 1998, and has actual Chicago nonprofit clients including the Chicago Community Trust and Chicago Children's Choir. Mightybytes Mightybytes Mightybytes

They also emphasize accessibility and build/design rather than treating the website as simply a technical project.

Best fit: nonprofit that wants a polished donor experience, strong storytelling, accessibility, and a strategic digital partner.

mightybytes.com

3. Sandstorm Design — best for a sophisticated donor experience

DirectionsWebsite[Call](tel:+1 773-348-4200)

Sandstorm is another strong Chicago option. It specializes in purpose-driven organizations and nonprofits and has substantial UX/accessibility expertise. Its nonprofit practice cites 20+ years of nonprofit experience and work with organizations including foundations and education-focused nonprofits. Sandstorm Design Sandstorm Design

I'd put them high on the list if you're redesigning the whole digital fundraising experience, rather than merely adding a donation form.

Best fit: larger nonprofit with ambitious UX, accessibility, content, and digital-strategy requirements.

sandstormdesign.com

4. Dialogue Theory — strong mission-driven alternative

DirectionsWebsite[Call](tel:+1 617-922-3790)

Dialogue Theory is a Chicago digital studio focused on mission-driven organizations, nonprofits and civic work. It's worth including if you want a smaller, more collaborative agency rather than a large development operation.

Best fit: organization that values strategy, storytelling and a close agency relationship.

5. Cybernautic Web Design — worth considering for a more conventional custom build

DirectionsWebsite[Call](tel:+1 312-878-1986)

Cybernautic has Chicago presence and experience with custom websites, payments/donations, accessibility and organizations with more complicated content/workflow needs.

Best fit: smaller-to-mid-sized organization wanting a custom website without necessarily undertaking an enterprise-scale digital transformation.

Who would I hire?

If I were advising your board, I'd narrow it to three RFP candidates:

My default recommendation: Mightybytes. They have unusually relevant nonprofit experience, including Chicago Community Trust, while still providing serious digital-development capabilities. Mightybytes

But if PCI/security is your overriding concern, I'd interview Promet first. Their background in secure, governed Drupal environments and complex organizations makes them particularly compelling for a security-sensitive build. Promet Source Promet Source Resources

One important PCI point

I'd change the wording of your RFP from:

"Build us a PCI-compliant donation page."

to something more specific:

"Design and implement a donation experience using a PCI-compliant payment processor, minimizing our PCI scope and ensuring that our website does not store or transmit raw cardholder data."

That's an important distinction. PCI compliance isn't simply a property of the webpage. Your organization, payment processor, hosting environment, integrations and handling of card data all affect your obligations.

For example, a good architecture can send the donor's payment information directly to a PCI-compliant processor and use tokens/hosted components rather than having your WordPress/Drupal server receive raw card numbers. Nonprofit web specialists explicitly recommend this kind of architecture. Cornershop Creative

I'd also consider using a nonprofit fundraising/payment platform rather than having the agency build payment processing from scratch. For example, Funraise states that it is PCI Level 1 certified, while Givecloud describes SOC 2 and PCI DSS controls. Funraise Givecloud

What I'd require in the RFP

Before selecting anyone, make these requirements mandatory:

• PCI DSS scope documented in writing
• Payment processor identified and its PCI certification documented
• No raw credit-card numbers stored in your CMS, database, logs or analytics
• Tokenized/hosted payment architecture where practical
• MFA for all administrative accounts
• WAF/CDN and automated vulnerability monitoring
• Regular CMS/plugin dependency updates
• Encryption in transit and at rest where applicable
• Secure backups and tested restoration
• Fraud/chargeback controls
• WCAG 2.2 AA accessibility target
• Privacy/data-retention documentation
• Incident-response procedure
• Penetration/security testing appropriate to the project's risk
• Clear ownership of source code, accounts and donor data
• Post-launch security maintenance included in the contract

Most importantly, ask each finalist to draw your proposed payment/data-flow diagram. You want to see exactly where donor information goes from the moment someone clicks Donate through payment, receipt, CRM synchronization and reporting.

If you tell me roughly your annual online donation volume, current website/CRM (e.g. WordPress + Salesforce), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you a suggested RFP scoring matrix.

mightybytes.com

3. Sandstorm Design — best for a sophisticated donor experience

Sandstorm is another strong Chicago option. It specializes in purpose-driven organizations and nonprofits and has substantial UX/accessibility expertise. Its nonprofit practice cites 20+ years of nonprofit experience and work with organizations including foundations and education-focused nonprofits. Sandstorm Design Sandstorm Design

I'd put them high on the list if you're redesigning the whole digital fundraising experience, rather than merely adding a donation form.

Best fit: larger nonprofit with ambitious UX, accessibility, content, and digital-strategy requirements.

sandstormdesign.com

4. Dialogue Theory — strong mission-driven alternative

Dialogue Theory is a Chicago digital studio focused on mission-driven organizations, nonprofits and civic work. It's worth including if you want a smaller, more collaborative agency rather than a large development operation.

Best fit: organization that values strategy, storytelling and a close agency relationship.

5. Cybernautic Web Design — worth considering for a more conventional custom build

Cybernautic has Chicago presence and experience with custom websites, payments/donations, accessibility and organizations with more complicated content/workflow needs.

Best fit: smaller-to-mid-sized organization wanting a custom website without necessarily undertaking an enterprise-scale digital transformation.

Who would I hire?

If I were advising your board, I'd narrow it to three RFP candidates:

My default recommendation: Mightybytes. They have unusually relevant nonprofit experience, including Chicago Community Trust, while still providing serious digital-development capabilities. Mightybytes

But if PCI/security is your overriding concern, I'd interview Promet first. Their background in secure, governed Drupal environments and complex organizations makes them particularly compelling for a security-sensitive build. Promet Source Promet Source Resources

One important PCI point

I'd change the wording of your RFP from:

"Build us a PCI-compliant donation page."

to something more specific:

"Design and implement a donation experience using a PCI-compliant payment processor, minimizing our PCI scope and ensuring that our website does not store or transmit raw cardholder data."

That's an important distinction. PCI compliance isn't simply a property of the webpage. Your organization, payment processor, hosting environment, integrations and handling of card data all affect your obligations.

For example, a good architecture can send the donor's payment information directly to a PCI-compliant processor and use tokens/hosted components rather than having your WordPress/Drupal server receive raw card numbers. Nonprofit web specialists explicitly recommend this kind of architecture. Cornershop Creative

I'd also consider using a nonprofit fundraising/payment platform rather than having the agency build payment processing from scratch. For example, Funraise states that it is PCI Level 1 certified, while Givecloud describes SOC 2 and PCI DSS controls. funraise.org givecloud.com

What I'd require in the RFP

Before selecting anyone, make these requirements mandatory:

For a nonprofit donation page, I would not hire a general web design shop based only on aesthetics. The right partner should understand:

• PCI DSS scope reduction (ideally keeping card data entirely off your servers)
• tokenized payment processing
• recurring giving flows
• donor CRM integrations
• accessibility (WCAG)
• security practices, monitoring, backups, and incident response
• nonprofit fundraising conversion strategy

A key point: your website vendor usually does not become “PCI compliant” by itself. The safest architecture is typically a secure donation processor (Stripe, Blackbaud, Funraise, Donorbox, etc.) handling payment data while your site embeds or links to a compliant donation experience. www.funraise.org

Chicago firms I would put on your shortlist

1. Mightybytes, Inc. — best overall fit for a sophisticated nonprofit

Mightybytes, Inc.
Mightybytes, Inc.
Web
Address: 1725 W Balmoral Ave, Chicago, IL 60640, United States
Phone: +1 773-561-7529
Why consider them: They specialize in mission-driven organizations and offer strategy, design, development, accessibility, and ongoing optimization. They are a strong fit if your donation page is part of a broader digital transformation rather than a simple form replacement.

Best for:

• mid-size to large nonprofits
• organizations needing integrations and governance
• accessibility-conscious builds

Ask them:

• “Which donation platforms have you integrated?”
• “How do you keep our PCI scope minimized?”
• “Can you provide security documentation and launch QA?”

2. Sandstorm Design — best for enterprise nonprofit websites

Sandstorm Design
Sandstorm Design
Web
Address: 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
Phone: +1 773-348-4200
Why consider them: Sandstorm has experience with mission-led organizations and complex web platforms, including Drupal/WordPress environments.

Best for:

• foundations
• universities
• large nonprofits
• organizations with complex content and governance needs

3. Promet Source — best for security-heavy or complex platforms

Promet Source
Promet Source
Web
Address: 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
Phone: +1 773-525-8255
Why consider them: They are known for open-source platforms, Drupal expertise, and work with organizations that require strong accessibility and governance practices.

Best for:

• large donor ecosystems
• custom integrations
• organizations with IT/security stakeholders

4. Dialogue Theory — best boutique option

Dialogue Theory
Dialogue Theory
Web
Address: 1932 S Halsted St #509, Chicago, IL 60608, United States
Phone: +1 617-922-3790
Why consider them: A smaller Chicago studio focused on digital experiences for mission-driven organizations.

Best for:

• nonprofits wanting senior attention
• redesigning a donation journey
• combining UX strategy with development

5. Windy City Web Solutions — best budget-conscious option

Windy City Web Solutions
Windy City Web Solutions
Web
Address: 801 S Wells St, Chicago, IL 60607, United States
Phone: +1 847-801-9482
Why consider them: They focus on WordPress builds, nonprofit websites, accessibility, maintenance, and donation integrations. windycitywebsolutions.com

Best for:

• small and mid-size nonprofits
• WordPress organizations
• straightforward donation upgrades

My hiring recommendation by nonprofit size

Beth Interactive is also worth considering if the bigger issue is increasing online giving conversion, donor journeys, and fundraising strategy rather than only building the page.

Questions I would put in your RFP

1. “Will you store any cardholder data?”

Preferred answer: No. We use a PCI-compliant payment processor and tokenization.

2. “What donation platforms do you have production experience with?”

Look for examples involving Stripe, Blackbaud, Funraise, Donorbox, Givebutter, Salesforce, or similar.

3. “Who is responsible for PCI compliance?”

They should clearly explain shared responsibility.

4. “How will you protect donor information?”

Expect answers involving:

• MFA
• least-privilege access
• secure hosting
• patching
• backups
• vulnerability management

5. “Can you show three nonprofit donation pages you built and the results?”

If I were choosing for a typical established Chicago nonprofit

My shortlist would be:

1. Mightybytes — strongest overall nonprofit/digital partner
2. Sandstorm Design — strongest enterprise choice
3. Promet Source — strongest technical/security choice
4. Dialogue Theory — strongest boutique partner
5. Windy City Web Solutions — strongest value option

I would run a paid discovery phase with the top 2–3 firms before committing to a full rebuild. The quality of their security architecture and donor-flow recommendations will tell you more than a portfolio alone.

For a nonprofit donation page, I would not hire a general web design shop alone. The right partner should understand three things together:

1. Donation conversion (UX, recurring gifts, campaign landing pages)
2. Payment security (PCI DSS-compliant payment flows, tokenization, avoiding storage of card data)
3. Nonprofit systems (Salesforce Nonprofit Cloud, Blackbaud, Bloomerang, Donorbox, Givebutter, Stripe, etc.)

A key point: your website developer usually should not handle raw credit-card data. A good architecture is a secure donation form/payment processor that is PCI compliant, embedded or integrated into your site, so your organization and web vendor minimize PCI scope. cornershopcreative.com

Here are Chicago-area firms I would put on your shortlist:

Who I would hire (depending on your situation)

If you are a small-to-medium nonprofit ($1M–$20M budget):
I would start with:

1. Mightybytes, Inc.
2. Windy City Web Solutions
3. Beth Interactive

If you are a larger nonprofit, hospital foundation, university, or national organization:
I would shortlist:

1. Promet Source
2. Sandstorm Design
3. Mightybytes, Inc.

Questions I would ask before signing anyone

Ask every finalist:

• “Will our site ever store, transmit, or process raw card numbers?”
• “What PCI DSS responsibility remains with our nonprofit versus the payment processor?”
• “Which donation platforms have you implemented: Salesforce, Blackbaud, Donorbox, Givebutter, Funraise, Stripe?”
• “Can you show three live nonprofit donation flows you built?”
• “How do you test recurring donations, failed payments, refunds, and receipts?”
• “Do you provide security monitoring, backups, patching, and incident response?”
• “Will we own the code, accounts, analytics, and integrations?”

My recommended selection process

I would invite three firms to a paid discovery phase (or detailed proposal):

1. Mightybytes — best overall nonprofit digital partner candidate.
2. Promet Source — best if security, integrations, and scale are priorities.
3. Beth Interactive — best if your main goal is increasing fundraising performance rather than only rebuilding technology.

If you tell me your nonprofit’s annual online giving volume, current platform (WordPress/Drupal/etc.), CRM (Salesforce/Blackbaud/etc.), and approximate budget, I can narrow this to a single recommended hire and a target project scope.

Yes. For a nonprofit, I’d avoid having a general web agency build its own credit-card payment system. The safer architecture is a strong Chicago web/digital firm + a PCI-compliant payment/donation platform, with the card data tokenized or handled entirely by the processor.

My Chicago shortlist

Why these rise to the top: Sandstorm has substantial enterprise/nonprofit web-development capabilities; Thirdwave has a strong custom-development/integration orientation; and Beth Interactive is specifically focused on philanthropy and donor engagement. The latter's work includes analyzing the journey from landing on a giving page through donation completion and stewardship. www.flamingoagency.com

Who I'd hire

If you're asking me to pick one without knowing your budget or existing technology: I'd interview Sandstorm Design first, and Beth Interactive second.

But I would make the RFP require them to use a PCI-compliant payment processor rather than storing card numbers on your website. That's a much more important architectural decision than whether the agency itself advertises "PCI compliance." For example, nonprofit web specialists describe using off-site/tokenized PCI-compliant payment services so sensitive card data isn't stored in the organization's WordPress database. cornershopcreative.com

For the donation platform, I'd evaluate options such as Give Lively, Funraise, Givecloud, or CharityWeb alongside your existing CRM. Funraise, for example, states that it is PCI Level 1 certified, while Givecloud documents PCI DSS and SOC 2 controls. www.funraise.org Give Lively similarly describes PCI Level 1 payment processing through Stripe and PayPal. www.givelively.org

What I'd put in the RFP

Require every bidder to answer these explicitly:

1. Where does cardholder data live? Ideally, nowhere in your CMS/server.
2. Which payment processor handles the transaction?
3. What PCI DSS responsibility remains with our nonprofit?
4. Who completes the SAQ and what type?
5. Is the donation form hosted, embedded, or tokenized?
6. Can we use Apple Pay/Google Pay and recurring donations?
7. Can donations flow automatically into our CRM/accounting system?
8. What happens if the donation processor is unavailable?
9. Do you perform vulnerability scanning and penetration testing?
10. What's included in post-launch security maintenance?
11. Can you provide nonprofit references with comparable donation volume?
12. Who owns the website code, accounts, analytics, and donor data?

One particularly important requirement: don't accept "we're PCI compliant" as the answer. Ask them to map exactly which PCI responsibilities belong to the agency, payment processor, hosting provider, and your organization.

If you tell me your approximate annual online donation volume, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Blackbaud, Bloomerang, etc.), and budget, I can narrow this to 2–3 Chicago firms and recommend the specific architecture I'd use.

For a nonprofit that needs a secure donation page with PCI compliance, I would not hire a general web designer alone. I would look for a firm that understands:

• PCI DSS-compliant payment flows (typically using Stripe, Blackbaud Merchant Services, PayPal, Classy, Donorbox, etc., rather than storing card data)
• Donation conversion optimization (recurring giving, mobile checkout, campaign pages)
• CRM integrations (Salesforce Nonprofit Cloud/NPSP, Blackbaud, EveryAction, Bloomerang, Neon One, etc.)
• Security practices (MFA, secure hosting, patching, access controls, backups)
• Accessibility (WCAG 2.1/2.2 AA)
• Nonprofit governance (training staff, documentation, maintainability)

Based on Chicago-area firms with nonprofit/digital experience, these would be my shortlist: clutch.co

My recommended shortlist

1. Mightybytes, Inc. — Best overall fit for a mission-driven nonprofit

Mightybytes, Inc.
Web
Address: 1725 W Balmoral Ave, Chicago, IL 60640, United States
Phone: +1 773-561-7529
Why consider them

• Strong nonprofit and purpose-driven organization experience
• Full digital strategy + UX + development capabilities
• Good fit if you need more than a donation form: storytelling, campaigns, analytics, accessibility, and ongoing improvement

Best for: mid-size nonprofits that want a strategic partner, not just a developer.

2. Sandstorm Design — Best for larger organizations and complex integrations

Sandstorm Design
Web
Address: 4422 N Ravenswood Ave #50, Chicago, IL 60640, United States
Phone: +1 773-348-4200
Why consider them

• Deep experience with mission-led organizations
• Strong UX, accessibility, and enterprise CMS work
• Better fit if you need integrations, governance, multiple stakeholders, or a large website rebuild clutch.co

Best for: foundations, universities, healthcare nonprofits, national nonprofits.

3. Promet Source — Best for technical complexity

Promet Source
Web
Address: 4809 N Ravenswood Ave #126, Chicago, IL 60640, United States
Phone: +1 773-525-8255
Why consider them

• Strong Drupal/open-source expertise
• Experience with complex content platforms and mission-driven organizations
• Good choice if your donation system needs to connect to multiple databases or enterprise systems

Best for: organizations with internal IT teams or complicated requirements.

4. Dialogue Theory — Best boutique/high-touch option

Dialogue Theory
Web
Address: 1932 S Halsted St #509, Chicago, IL 60608, United States
Phone: +1 617-922-3790
Why consider them

• Smaller studio model
• Focus on digital experiences for mission-driven organizations
• Potentially better if you want senior-level attention and a collaborative process

Best for: nonprofits that value strategy and close collaboration.

5. Advocate Creative — Best nonprofit communications partner

Advocate Creative
Web
Address: 320 N Damen Ave d301, Chicago, IL 60612, United States
Why consider them

• Nonprofit/foundation specialization
• Strong storytelling and communications background
• Good if the challenge is donor engagement as much as technology

Best for: advocacy organizations, foundations, community nonprofits.

Who I would hire by nonprofit size

Questions I would ask every finalist

1. “Who handles PCI compliance—the agency, our payment processor, or us?”

A good answer is usually: the site never stores card data; payments are handled by a PCI-compliant processor using hosted fields/tokenization.

2. “Can you show three nonprofit donation flows you built?”

3. “Which donation platforms have you integrated?”
   • Stripe
   • Blackbaud
   • Classy
   • Donorbox
   • Givebutter
   • Salesforce
   • Bloomerang

4. “What security controls are included after launch?”
   • MFA
   • vulnerability updates
   • backups
   • monitoring
   • admin access reviews

5. “Who owns the code, hosting account, analytics, and integrations?”

My recommendation if I were running the vendor selection

I would invite Mightybytes, Sandstorm Design, and Promet Source to a short RFP. They represent three different strengths: fundraising-focused digital strategy, enterprise nonprofit experience, and technical architecture.

Before choosing, I would make PCI architecture a scored requirement—not just ask whether they say “PCI compliant.” A trustworthy firm should explain exactly where donor payment data lives, what they manage, and what your organization is responsible for.

Yes. For a nonprofit, I would not hire a firm simply because it says “PCI compliant.” The strongest setup is usually:

Chicago web/digital firm + PCI-compliant payment/donation platform, with the payment provider handling card data rather than your website storing it.

Based on current Chicago-area options and their published nonprofit/security capabilities, I’d shortlist these:

Who I'd hire

My first call would be Soliant if you already use Salesforce or expect to. Their nonprofit practice specifically covers fundraising, donor management, website integration and Salesforce Nonprofit Cloud/NPSP, and they have demonstrated nonprofit donation implementations. www.soliantconsulting.com

If your primary objective is increasing donations rather than building a complicated technology stack, I'd put Beth Interactive first. Their specialization is digital philanthropy and donor engagement rather than generic corporate web development. bethinteractive.com

If you need a highly customized donation application with stringent technical/security requirements, I'd interview Simpalm alongside Soliant. Its Chicago practice explicitly advertises PCI-compliant web development and nonprofit fundraising functionality. www.simpalm.com

One important PCI point

I'd make this a requirement in the RFP:

Your firm must implement the donation page so that your organization does not store or transmit raw cardholder data, using a PCI DSS-compliant payment processor/tokenized payment integration.

That's much better than asking an agency to make your WordPress/database itself "PCI compliant." For example, nonprofit web specialists such as Cornershop Creative describe using off-site/tokenized PCI-compliant payment services so card data isn't stored in the WordPress database. cornershopcreative.com

You could pair the website with a PCI Level 1 fundraising platform such as Funraise, which currently states that it is PCI Level 1 certified, or Fundraise Up, which states PCI DSS Level 1 and SOC 2 Type II compliance. www.funraise.org

What I would put in your RFP

Require finalists to demonstrate:

• PCI DSS responsibility matrix — who is responsible for what
• No storage of full card numbers/CVV in your CMS or CRM
• Tokenized payment processing
• MFA for administrators
• WAF/firewall and malware monitoring
• Vulnerability scanning and penetration testing
• Automatic security updates and backups
• WCAG 2.2 AA accessibility
• Fraud/chargeback controls
• Recurring donations and Apple Pay/Google Pay
• Donor receipt and tax-document workflows
• Salesforce/CRM integration, if applicable
• Incident-response procedures and breach notification
• Written documentation of the PCI scope and annual compliance process
• At least 2 nonprofit references with comparable donation volume

My practical shortlist would be: Soliant + Beth Interactive + Simpalm. Have all three price the same donation architecture so you're comparing firms rather than three different interpretations of the project.

If you tell me your annual online donation volume, current website/CMS, CRM (e.g. Salesforce/Blackbaud), and approximate budget, I can narrow those three to a specific recommendation and identify the best donation/payment platform to pair with the firm.

Yes. For a nonprofit, I’d prioritize a firm that does not put raw card data on your website and instead integrates a PCI-compliant payment processor/donation platform. That generally reduces your PCI scope and ongoing compliance burden.

My Chicago shortlist

1. Plego Technologies — best for a custom build
   • Chicago-based custom web/software development firm.
   • Better fit if you need a donation experience integrated with a CRM, membership system, custom database, or other internal systems.
   • Their capabilities include web applications, cloud infrastructure, security and compliance work.
   • My pick if your donation page is part of a larger custom digital project.

2. Sandstorm Design — best for a larger, mission-driven organization
   • Chicago agency with a strong focus on purpose-driven organizations, UX, accessibility and enterprise web development.
   • Particularly attractive if you need a substantial website redesign in addition to the donation experience.
   • My pick if donor UX, accessibility and overall digital strategy matter as much as payment processing.

3. Cybernautic Web Design — good website-development option
   • Chicago agency doing custom websites and highlighting payments/donations and accessibility among its capabilities.
   • Worth including in an RFP, particularly for a WordPress/custom-site project.

4. CharityGiving — best if the donation infrastructure itself is the priority
   • Chicago-based fundraising/donation-management software company.
   • Its platform is specifically aimed at nonprofit fundraising and donation management, with PCI/SSL security claims.
   • This is potentially a better route than commissioning a developer to build payment functionality from scratch.

5. GiveCentral — another nonprofit-focused Chicago option
   • Chicago-area giving platform focused on online and recurring donations, fundraising pages and donor management.
   • Its materials cite PCI compliance and SOC 2-related security controls.
   • Worth considering if you want an established fundraising platform rather than bespoke payment development.

Who I'd hire

If you want a custom donation page integrated into your existing website/CRM: I'd start with Plego and Sandstorm.

If the primary objective is simply a highly secure, branded donation experience: I'd investigate CharityGiving/GiveCentral before paying an agency to build the payment infrastructure themselves.

That's because PCI compliance isn't just a checkbox for the developer. The architecture matters. For example, eWay Corp's nonprofit guidance specifically recommends architecting the site so the payment processor handles cardholder data rather than allowing that data to pass through the CMS. www.ewaycorp.com

You could also have a Chicago agency build the front-end donor experience while using a PCI-certified nonprofit fundraising/payment platform underneath it. Platforms such as Givecloud advertise PCI DSS and SOC 2 Type II controls, while Funraise says it is a PCI Level 1 certified service provider. givecloud.com

What I would put in your RFP

Don't simply ask, "Can you build a PCI-compliant donation page?" Ask:

• Who is the PCI-certified payment processor/service provider?
• Will our website ever receive, transmit, or store full card numbers or CVVs?
• What PCI DSS scope will remain with our nonprofit?
• Will you provide the appropriate PCI SAQ and responsibility matrix?
• How are recurring payments/tokenized payment methods handled?
• How are refunds, chargebacks and fraudulent transactions handled?
• What donor data goes into our CRM, and what data stays with the payment provider?
• Is the donation form accessible to WCAG 2.2 AA standards?
• What security testing, vulnerability scanning and penetration testing are included?
• Who handles security patches after launch?
• What happens if the agency relationship ends—do we own the code, accounts and data?
• Can you provide two nonprofit references with comparable donation volume?

One important distinction: “PCI compliant” by itself isn't enough. You want the vendor to explain how PCI compliance is achieved and exactly what your organization's remaining obligations are.

My recommendation: solicit proposals from Plego, Sandstorm, and CharityGiving, but structure the RFP so that the first two can propose an agency + PCI-certified payment-platform architecture rather than building payment processing themselves. That will give you a much safer apples-to-apples comparison.

If you tell me your annual online donation volume, approximate budget, current website/CMS (e.g. WordPress), and CRM (Salesforce, Bloomerang, Blackbaud, etc.), I can narrow this to the one I'd hire and the architecture I'd specify.

Yes. I’d treat this as two separate buying decisions: (1) who designs/builds the donor experience and integrations, and (2) which payment/donation platform actually handles card data. For PCI, I would strongly favor an architecture where your organization never handles raw card numbers and the payment processor hosts the sensitive payment fields.

My Chicago shortlist

Who I'd hire

My first choice would be Beth Interactive, assuming your organization wants a polished donation experience and wants the agency to think about fundraising results, donor journeys, campaigns and analytics—not merely code the page. They're unusually specialized: their stated focus is digital philanthropy and strategic communications for nonprofits, and they report $43.6M+ raised for clients in 2025. bethinteractive.com

I'd ask Beth Interactive to propose a solution using a PCI-compliant payment provider rather than building/storing payment-card functionality themselves.

For the actual payments layer, Stripe is a particularly strong option. Stripe specifically supports nonprofits, recurring donations, mobile-friendly checkout and fraud prevention, and says its infrastructure processes payments for millions of organizations. stripe.comwww.givelively.org

Another good architecture is to use a dedicated nonprofit fundraising platform. For example, Funraise states that it is a PCI Level 1 certified service provider, uses AWS infrastructure, encrypts data and follows OWASP development practices. www.funraise.org Give Lively similarly documents PCI Level 1 payment processing through Stripe and PayPal. www.givelively.org

The important PCI distinction

Don't accept a proposal that simply says "the donation page will be PCI compliant." Ask exactly:

1. Who is the PCI DSS–certified payment processor?
2. Does cardholder data ever touch our servers?
3. Will you use hosted/tokenized payment fields or a redirect/hosted checkout?
4. What PCI DSS SAQ will our organization have to complete?
5. Who maintains the compliance documentation?
6. How are recurring-payment tokens stored?
7. What happens if the website is compromised?
8. Do you provide vulnerability scanning, penetration testing and incident response?
9. Can our CRM receive donor/payment status without receiving card data?
10. Who owns the code, domain, analytics, donor data and integrations if we terminate the contract?

That architecture matters more than whether a web agency puts "PCI compliant" on its website.

My recommended procurement approach

I'd actually invite three proposals:

• Beth Interactive — best overall nonprofit fundraising partner.
• Glantz Design — best comparison for a custom web/UX build.
• CharityGiving or GiveCentral — best comparison against a purpose-built fundraising platform.

Then give all three the same requirements, including your expected annual donation volume, average gift, recurring-giving percentage, CRM (Salesforce/Raiser's Edge/Bloomerang/etc.), website CMS, accessibility requirements, reporting requirements and whether you need event/peer-to-peer fundraising.

If you tell me your nonprofit's approximate annual online donations, current website/CMS, CRM, and whether you need recurring gifts, I can narrow this to a specific recommendation and give you a vendor-by-vendor comparison of likely cost, PCI architecture, integrations, and implementation risk.

Yes. For a nonprofit, I would not hire a generic Chicago web-design shop to build a custom credit-card form from scratch. I’d hire a firm that understands nonprofit fundraising UX and has the technical discipline to keep cardholder data out of your website wherever possible.

My Chicago shortlist

1. Beth Interactive — my overall recommendation

Beth Interactive

This is the firm I'd interview first. They're Chicago-based and specifically focused on digital philanthropy, donor engagement, annual giving and nonprofit fundraising, rather than treating a donation page as just another website form. Their current site says they've raised $43.6M+ on behalf of clients in 2025 and work with nonprofits nationwide. bethinteractive.com

They also perform digital donor-journey audits, examining the experience from arriving at the giving page through completing the donation and receiving the acknowledgment. bethinteractive.com

Caveat: I'd make them prove their PCI architecture in the proposal. Their fundraising expertise is clear, but I wouldn't assume that means they themselves are your PCI-compliant payment processor.

2. Dialogue Theory — best for a sophisticated rebuild

Dialogue Theory

I'd put them on the shortlist if you're looking for a broader website + digital experience project rather than simply a donation-page redesign. Their Chicago operation focuses on mission-driven organizations and complex digital initiatives; they've also built multilingual experiences for major Chicago nonprofits. www.dialoguetheory.com

For PCI, I'd require them to integrate a PCI-compliant payment provider rather than handle raw card data themselves.

3. LimeRed Studio — best design/mission fit

LimeRed Studio

LimeRed is particularly interesting if your donation page needs to be part of a larger brand, storytelling and UX overhaul. Their Chicago office focuses on purpose-driven organizations and nonprofit clients, with web design/development among their capabilities.

Again, I'd make PCI architecture a contractual requirement rather than relying on a generic "secure website" promise.

An important distinction about PCI

I'd actually make this the centerpiece of your RFP.

The safest architecture is usually:

Your website → secure donation component/payment processor → card network

rather than:

Your website → your own server → credit-card information

For example, nonprofit platforms such as GoFundMe Pro state that they're a PCI DSS Level 1 service provider and use payment partners such as Stripe and PayPal. www.classy.org Funraise similarly states that it is PCI Level 1 certified. www.funraise.org

That means your agency can concentrate on making the donation experience beautiful and conversion-oriented while a specialized payment platform handles the most sensitive payment infrastructure.

Who I'd hire

If you're a typical established nonprofit:
I'd invite Beth Interactive, Dialogue Theory and LimeRed to pitch.

If fundraising performance is the #1 objective: Beth Interactive is my pick.

If you're rebuilding your entire digital ecosystem: Dialogue Theory would probably be my pick.

If this is primarily a brand/website redesign with a donation component: LimeRed is compelling.

I would not select based on the phrase "PCI compliant" in a proposal alone. Ask each finalist these five questions:

1. Will our website ever receive, process, transmit or store raw card numbers?
2. Exactly which payment processor/donation platform will handle the card transaction?
3. Who is responsible for PCI DSS compliance—the agency, us, or the payment provider—and what documentation will we receive?
4. Can you provide the provider's current PCI Attestation of Compliance (AOC) or equivalent evidence?
5. What happens if the donation platform or integration is compromised, and who handles incident response?

I'd also require WCAG 2.2 AA accessibility, MFA for administrators, least-privilege access, encrypted connections, automated backups, vulnerability/patch management, fraud controls, and a written incident-response process. Secure payment processing alone doesn't make the entire donation experience secure.

Bottom line: If you give me your approximate annual online donation volume, current website/CRM (e.g. WordPress, Salesforce, Blackbaud), and budget, I can narrow this to the 2–3 firms I'd actually put in your RFP and tell you what I would ask each one to build.

Yes. For a nonprofit, I would not hire a general web designer to build the payment processing itself. I’d hire a strong nonprofit web firm to build the site/donation experience and have the actual card handling occur through a PCI-compliant payment/fundraising platform. That materially reduces your PCI exposure.

My Chicago shortlist

1. Sandstorm Design — my first call for a larger nonprofit.
Sandstorm specifically works with nonprofits and says its nonprofit practice combines UX research, conversion strategy and scalable technology to improve donations. Its portfolio includes organizations such as the Illinois Holocaust Museum & Education Center and MPN Research Foundation. www.sandstormdesign.com

The caveat is cost: current third-party project data puts its minimum project size around $100,000, so I wouldn't choose it for a relatively simple donation-page project. clutch.co

2. Promet Source — my choice if security, accessibility and complex integrations dominate.
Promet is headquartered in Chicago and specializes in secure, scalable open-source websites for mission-driven organizations. It has particularly deep Drupal experience and emphasizes accessibility and ongoing security/maintenance. www.prometsource.comwww.prometsource.com

3. Flamingo Agency — probably the most sensible option for a smaller organization.
Flamingo specifically markets nonprofit sites in Chicago, builds in WordPress, and says it integrates Stripe, PayPal and other nonprofit payment systems for one-time and recurring donations. It publicly estimates many nonprofit projects at $4,000–$10,000, although your actual quote could be considerably different. www.flamingoagency.com

4. Big Human — worth an RFP if you need custom functionality.
Big Human explicitly offers nonprofit development, secure donation forms, security/QA/compliance validation, and integration with CRMs and payment systems. www.bighuman.com

The important PCI distinction

I'd put this requirement in your RFP:

The agency must not store, process, or transmit raw donor cardholder data through the nonprofit's website infrastructure. Payment processing must be performed by a PCI DSS-compliant payment service provider using hosted fields, tokenization, or an equivalent architecture.

That's preferable to asking an agency to make your WordPress/Drupal server itself "PCI compliant."

For example, Funraise says it is a PCI Level 1 certified service provider, while Give Lively describes its use of PCI Level 1 payment processors. Givecloud reports SOC 2 Type II auditing and PCI DSS compliance for its payment environment. www.funraise.org

A good implementation could therefore look like:

Your website → branded/embedded donation experience → PCI-compliant processor → CRM

rather than:

Your website → credit-card numbers → your server/database

Who I would hire

If your organization is established and the donation system is strategically important, I'd invite Sandstorm + Promet + one lower-cost firm such as Flamingo to bid.

If I had to pick one without knowing your budget, I'd lean Promet Source because the combination of Chicago presence, nonprofit/mission-driven experience, accessibility, security and scalable technical architecture is unusually well aligned with what you're asking for. www.prometsource.comwww.prometsource.com

If you're a smaller nonprofit with a $5k–$20k-ish web budget, I'd lean toward Flamingo + a proven PCI-compliant donation platform, rather than paying an agency to custom-build fundraising infrastructure. www.flamingoagency.com

If you're doing a six-figure institutional website/digital transformation, I'd put Sandstorm at the top of the RFP list. clutch.co

If you tell me roughly your annual online donations, website budget, current CMS (WordPress/Drupal/etc.), CRM (Salesforce, Blackbaud, Bloomerang, etc.), and whether you need recurring donations, I can narrow this to the best 2–3 firms and recommend the exact donation/PCI architecture I would put in the RFP.

Yes. For a Chicago nonprofit, I’d hire a nonprofit-focused digital agency to build the donor experience, but have a PCI-validated payment provider handle the actual card data. That distinction matters: PCI DSS compliance isn't something a web agency can simply “add” to a page. PCI SSC says that for the simplest SAQ A model, payment-page elements must originate from PCI-compliant service providers, with the applicable eligibility criteria met. www.pcisecuritystandards.org

My Chicago shortlist

Why Beth Interactive is my #1: it is unusually focused on digital philanthropy, rather than being a general web shop. The Chicago firm works specifically with nonprofits on donor engagement, annual giving, communications and analytics, and says it raised $43.6M+ on behalf of clients in 2025. bethinteractive.com

Beth Interactive

Mightybytes is another particularly strong option if accessibility, security, sustainability and responsible technology matter to your board. It's a Chicago Certified B Corp, has extensive purpose-driven/nonprofit experience, and says its deliverables meet WCAG 2.2 AA by default. www.mightybytes.com

Mightybytes

EDUCO is attractive if this is really a website redesign + fundraising experience project. It specializes in nonprofits and says it has more than 20 years of nonprofit web-design experience, including work with LISC Chicago, Women Employed, Housing Forward and BUILD Chicago. www.educowebdesign.com

EDUCO

Dialogue Theory is the one I'd investigate for a more ambitious custom build. It explicitly works with nonprofits and civic organizations and handles strategy, design and development of digital experiences. www.dialoguetheory.com

Dialogue Theory

The architecture I'd require

I would not ask the agency to build a form that directly collects and stores credit-card numbers.

Instead:

Your website → branded donation experience → PCI-validated payment provider → processor

The agency should integrate something such as a PCI Level 1 nonprofit fundraising/payment platform. For example, Funraise states that it is PCI Level 1 certified, while GoFundMe Pro likewise identifies itself as a PCI DSS Level 1 service provider. www.funraise.org

That gives you a much cleaner security model and reduces the amount of PCI scope your organization has to manage. PCI SSC specifically distinguishes between fully outsourced payment processing and embedded payment forms, with different SAQ implications. www.pcisecuritystandards.org

Who I'd hire

If I were running your procurement process, I'd invite three firms to bid:

1. Beth Interactive — best fundraising/donor-conversion candidate.
2. Mightybytes — best security/accessibility/responsible-web candidate.
3. Dialogue Theory or Adage — best candidate if you need significant custom technology/integrations.

Then I'd award the work to whoever can demonstrate the strongest combination of nonprofit fundraising UX + PCI architecture + CRM integration, rather than whoever produces the prettiest mockup.

One important procurement requirement: ask each finalist to name the exact payment provider, provide its current PCI Attestation of Compliance (AOC), explain whether your organization will qualify for SAQ A or another SAQ, and specify exactly what donor/card data will touch your website, CMS, analytics tools and servers. Don't accept “PCI compliant” as a sufficient answer.

If you tell me your approximate annual online donation volume, current website/CMS (e.g. WordPress), CRM (Salesforce, Raiser's Edge, Bloomerang, etc.), and budget, I can narrow this to the single firm I'd hire and the payment stack I'd pair with it.

Yes. For a nonprofit, I would not hire a general web agency to build a custom credit-card form from scratch. The safer architecture is for the agency to build the donation experience while a PCI-validated payment provider handles card data. PCI SSC says fully outsourced/third-party payment pages can reduce the merchant's PCI scope, although the website still has PCI responsibilities. www.pcisecuritystandards.org

My Chicago shortlist

Who I would hire

If you're a medium-to-large nonprofit, my first call would be Soliant. Their combination of nonprofit fundraising, Salesforce, website integration and payment-platform experience is particularly compelling. Their documented Philadelphia Bar Foundation project included donations and fundraiser/event management, and they explicitly discuss integrating donation forms and payment processors. www.soliantconsulting.com

I'd put Sandstorm second if you're undertaking a major brand/site redesign, and Cybernautic second/third if the project is primarily a secure, well-designed website and donation experience rather than a major CRM transformation.

One important caveat about "PCI compliant"

Put this requirement into your RFP:

The vendor must design the donation flow so that our organization does not receive, transmit, or store raw cardholder data, and must document the resulting PCI DSS scope, applicable SAQ, payment processor responsibilities, and required security controls.

That's more meaningful than simply asking, "Are you PCI compliant?"

For example, PCI SSC distinguishes between a payment page where the PCI-compliant processor supplies all payment-page elements and one where your website supplies some of those elements. The latter can result in a broader PCI assessment (e.g., SAQ A-EP rather than SAQ A). www.pcisecuritystandards.org

I'd also require the selected vendor to provide:

• PCI DSS responsibility matrix / shared-responsibility document
• Payment processor's current PCI compliance documentation
• Written data-flow diagram showing where donor/card data goes
• No storage of CVV or raw card numbers by your organization
• Encryption in transit and at rest
• MFA for administrative accounts
• Vulnerability scanning and patching
• Web-application firewall/CDN where appropriate
• Audit logging and incident-response procedures
• WCAG 2.1 AA accessibility testing
• Secure recurring-donation/tokenization architecture
• A documented process for PCI SAQ completion and annual validation

One more option: if you don't actually need a custom payment system, I'd seriously consider having one of these Chicago firms build the website around a mature nonprofit fundraising platform rather than developing the payment infrastructure themselves. Blackbaud, for example, states that its donation forms are PCI compliant and that it encrypts/tokenizes card information; Givecloud similarly advertises PCI DSS and SOC 2 controls. www.blackbaud.com

If you tell me your approximate annual online donations, current website/CRM (WordPress, Drupal, Salesforce, Blackbaud, etc.), and budget, I can narrow this to the 2–3 firms I'd actually invite to bid and give you an RFP scoring matrix.

Yes. For a nonprofit that needs a secure, PCI-conscious donation experience, I would not hire a generic web designer and ask them to “make the donation form secure.” I’d hire a firm that has demonstrable nonprofit fundraising experience and build the payment flow so that raw card data never reaches your website’s servers. Stripe, for example, supports hosted donation pages and payment components specifically designed to reduce the PCI burden. support.stripe.comstripe.com

My Chicago shortlist

Who I'd hire

I'd start with Cybernautic. They are the strongest match I found for your specific combination of Chicago + nonprofit + custom website + secure online donations. Their Promise Council project is particularly relevant: they describe building a mobile-friendly donation platform supporting one-time and recurring gifts, and they have a dedicated online-payment implementation using Stripe. www.cybernauticdesign.com

I'd then get a competing proposal from CharityGiving if your primary concern is the fundraising/payment infrastructure rather than a complete website redesign.

If your organization already has a good website and you're really asking, “Who should build just the donation page?”, I would actually consider not having an agency build the payment processing at all. Have the agency build the donor-facing experience around a PCI Level 1 processor such as Stripe. Stripe offers hosted donation pages, recurring donations and customizable payment experiences, and eligible U.S. nonprofits can request nonprofit processing rates. stripe.com

The security requirement I'd put in your RFP

Don't simply write “PCI compliant.” Require the vendor to explain:

1. Where card numbers are entered.
2. Whether card data ever touches your servers, WordPress database, CRM, analytics tools, or logs.
3. Which PCI-certified payment processor is being used.
4. Whether the processor provides tokenization rather than storing card numbers in your systems.
5. How recurring donations and failed-card retries work.
6. How they prevent card-testing/fraud attacks.
7. Who is responsible for the nonprofit's PCI documentation and annual compliance obligations.
8. MFA, role-based access and audit logging for staff.
9. Vulnerability scanning, patching, backups and incident response.
10. How donor data gets transferred into your CRM without exposing payment information.

That architecture matters more than the agency's marketing claim that its “website is PCI compliant.” Stripe's own nonprofit guidance specifically recommends hosted donation forms, PCI Level 1 processors, tokenization, fraud detection and minimizing manual handling of payment data. support.stripe.comstripe.com

My ranking for your situation:
1. Cybernautic → 2. CharityGiving → 3. Flamingo Agency → 4. Nonprofit Megaphone → 5. UHA Solutions.

If you tell me your annual online donation volume, current website/CMS (WordPress, Drupal, etc.), CRM (Salesforce, Bloomerang, Blackbaud, etc.), and approximate budget, I can narrow this to the one I'd hire and the payment architecture I'd specify in the contract.