Kranich - Donation Checkout with SEPA, Tax Receipts and Card-Testing Protection Built In
Online Giving Platform for a German Humanitarian NGO
Designed and built a clickable donation checkout and giving admin for a humanitarian NGO in Kassel: mobile-first donation forms with impact-led amounts, card, SEPA Direct Debit, PayPal, wallets and iDEAL, refunds that respect staff limits and tax receipts, and a risk monitor that stops card testing before it freezes the PSP account.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, donations list with quick view, donation detail with 5 tabs and a payment timeline, the form builder with a live German donation page preview, and the risk monitor with held payments and blocklist.
A supporter care officer can refund up to 500 €. Anything larger goes to Finance for approval, and every refund states what happens to the receipt: cancelled, reissued for the new amount or left out of the annual receipt.
Normal, Elevated and Lockdown. The demo alert peaks at 142 card attempts per minute and switches on a forced captcha and a 10 € card minimum for 60 minutes, with 4 payments held for review.
Gifts and payment attempts across 8 statuses from 27 donors, 5 campaigns, 3 donation forms, 6 payment methods, 8 approved impact lines, 7 staff roles and 8 blocklist entries.
The Problem
Lindenquell's donation form was a website plugin that posted to one PSP account and emailed the fundraising team. It was slow on phones, took only card and PayPal and could not take a SEPA mandate. When an earthquake appeal went viral, bots tested more than 9,000 stolen cards in one night and the PSP froze the account for two days at the peak of giving. Monthly donors had to phone to change a gift, tax receipts were mail-merged by hand each February, and finance spent four days a month matching payouts to gifts.
Our Solution
Kranich covers everything between "Jetzt spenden" and the money arriving in the bank. Donors give on a fast, accessible form with their preferred method, staff see every gift and payment attempt in one place, refunds respect each person's limit and the receipt rules, and a risk monitor detects card testing and raises protection automatically.
The Challenge: Taking Gifts Without Breaking Trust
Online giving in Germany sits between tax law, payment rules and the donor's trust. A receipt that survives a refund, a SEPA mandate without evidence or a form taken over by bots can each cost the organisation money, its seal or its PSP account.
Receipts the Organisation Is Liable For
Donors deduct gifts under § 10b EStG with a Zuwendungsbestätigung, or a simplified proof for gifts up to 300 €. Receipts must cite a current Freistellungsbescheid, and the organisation can be liable for incorrect ones, so a refunded gift must never keep a valid receipt.
Every Method Has Its Own Rules
PSD2 requires strong customer authentication for most card payments, with later monthly charges run as merchant-initiated. SEPA Direct Debit needs a creditor ID, a mandate reference, pre-notification and an 8-week refund right, and online mandates put the evidence burden on Lindenquell.
Bots on the Donation Form
Card testers use small gifts to check stolen cards. Without velocity rules, captcha and holds, one night of attacks can trigger a PSP freeze during an emergency appeal, exactly when genuine donors most want to give.
Persuasion Within the Seal
The DZI Spenden-Siegel expects truthful appeals without pressure tactics, analytics and test cookies need consent under the TDDDG, and Lindenquell builds the checkout to WCAG 2.1 AA as if the BFSG applies. Conversion work has to fit inside all of that.
Our Approach: From Giving Rules to a Clickable Checkout
Spec and Rules Research
Mapped 7 staff roles plus donors and peer-to-peer fundraisers, 41 screens (29 staff and 12 public), and the data model for donations, payment attempts, SEPA mandates, recurring gifts, receipts, risk rules, refunds, returns, disputes and payouts. Wrote down the rules the design follows: § 10b EStG and § 50 EStDV receipts, PSD2 SCA, the SEPA Core rulebook, PCI DSS SAQ A, GDPR, TDDDG, BFSG and the DDG Impressum.
Clickable Demo on a Production UI Kit
Built 5 key screens on a production dashboard kit: the dashboard with KPIs, raised by day, method mix, a live gifts ticker and a needs attention list; donations with status pills and a quick view; donation detail with refunds, receipts and the payment attempt timeline; the form builder with a live mobile, desktop and embed preview; and the risk monitor with signals, held payments and blocklist. All actions run on local state.
What a Production Build Adds
Integration with the card PSP (such as Stripe, Adyen or Mollie), PayPal Checkout, a SEPA provider, IBAN validation, Friendly Captcha or Cloudflare Turnstile, the donor CRM, Postmark or Brevo email and a DATEV export. Staff sign-in with two-factor authentication and roles, a full audit log, receipt runs, payout matching, the remaining staff screens, the standalone public pages and the donor account.
Why It Works: Rules Built Into Every Step
Impact Copy Tied to Real Costs
Each suggested amount can only use an approved line from the impact library, such as "35 €: Sauberes Trinkwasser für eine Familie", and each line records its programme cost and review date. Custom amounts stay within the 5 € to 10,000 € online policy.
Receipts Follow the Money
Every gift shows its receipt status: simplified proof, queued with a reason, issued, in the annual receipt, cancelled or blocked. A refund states its receipt effect before it is confirmed, and held, returned or disputed gifts cannot be receipted.
Protection That Explains Itself
When a card-testing pattern appears, the risk monitor shows the spike, the measures applied and when they end. Held payments list their rule hits, IP and card country, and staff release or cancel each one with a decision and a note.
An Accessible Form by Default
The form builder checks the button colour against WCAG 2.1 AA and blocks publishing if contrast fails. Fee cover starts unticked, wallets show first, card details stay in the PSP's hosted fields, and the SEPA step shows the mandate text and the 8-week refund right.
Related case studies
View all: Nonprofit & NGO
Bothy - Donor CRM with Consent, Gift Aid and Suppressions Built In
Designed and built a clickable donor CRM for a Perth-based wildlife charity registered with OSCR: supporter records that show what each person agreed to and how, Gift Aid claims that hold back gifts with a problem, and mailing selections that remove every suppression before a file goes out.
Gleaner - Volunteer Management Platform with Verified Hours and Screening Built In
Designed and built a clickable volunteer management platform for a regional food bank network in Ohio: shifts colored by how full they are, a volunteer directory and profile with readiness, screening and consent in one place, and an hours review queue that flags anything a person should check before it counts.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab