Not owning your payment gateway means if your nonprofit ever has to switch fundraising platforms, you’ll likely have to reach out to every single donor to have them rekey their payment information in. It’s no small task, and some recurring donors are lost in the process.
When a donor types their credit card into your donation page and hits “give,” where does that information actually go? Most nonprofit teams have never had a reason to ask. And it turns out the answer matters a lot more than you’d think… especially if you run a monthly giving program.
I’ve spent more than 25 years helping small and midsize nonprofits raise money online, and I’ve noticed the payment gateway concept can be a little confusing for my clients.
People use it interchangeably with “payment processor,” “merchant account,” and even “the donation form itself.”
That’s understandable—most discussions on the subject blur the same lines. But these pieces do different jobs, and the differences decide something important: whether your monthly donors easily stay yours if you ever switch fundraising platforms.
📬 Get fundraising strategies like this in your inbox. Join thousands of nonprofit pros getting practical, no-fluff fundraising guidance from our team. Subscribe to the newsletter.
Table of contents
- The four pieces of online giving (and why they get tangled up)
- How does a payment gateway actually work?
- What’s a recurring donation token—and where does it live?
- Why does this matter so much for nonprofits specifically?
- Which payment gateways do nonprofits usually use?
- How can you tell where your data actually lives?
- How we think about gateways at 4aGoodCause
- Frequently asked questions about nonprofit payment gateways
The four pieces of online giving (and why they get tangled up)
Behind every online donation, four separate things are working together. They’re easy to confuse because, on a good day, you never see any of them.
So I’ll use the analogy I’ve leaned on for over 20 years, because it cuts through the jargon faster than any technical diagram.
Picture a physical store:
- Your fundraising platform is the store itself—the layout, the signage, the donation pages and forms, everything that makes it easy for a supporter to walk in and give. This is the software you log into every day.
- The payment gateway is the cash register, the terminal a donor “swipes” their card through. For online giving, it’s a virtual register: It securely captures the card details, encrypts them, and passes them down the line for approval. (In a store with a physical counter, this is also where a card reader or payment terminal would plug in.)
- The payment processor is the courier running between the register and the banks—carrying the request to the card networks, getting a yes or no, and reporting back in about two seconds.
- The merchant account is the armored bank truck that rolls up, empties the register, and drops the money into your organization’s bank account. It’s a special holding account that money lands in before it settles into your everyday checking.
When you “own your processing,” you own the register and you’re on a first-name basis with the truck driver. When a platform owns those pieces for you, it decides when the truck comes, how much it leaves behind, and—in a worst case—whether it shows up at all.
A few definitions to make those roles concrete, since these are the terms you’ll run into when you evaluate any fundraising software:
- Payment gateway: The technology that securely collects a donor’s credit card details or bank account information at checkout and hands them off for authorization. Think of it as the secure front door for online transactions. (When you hear “online payment gateway” or “hosted payment gateway,” that’s the same thing, just describing where the checkout page is hosted—more on that below.)
- Payment processor: The company that actually moves the transaction between the card networks (Visa, Mastercard, American Express) and the banks involved. Some people call this a payment service provider, or PSP.
- Merchant account: A specialized bank account, held at a merchant bank or acquiring bank, where card funds settle before they reach your regular nonprofit bank account.
- Fundraising platform: The software layer your team and donors actually touch—your donation pages, donor records, receipting, and reporting. (That’s 4aGoodCause’s home turf.)
Here’s the wrinkle that trips people up, and it’s the single most useful thing to understand: Depending on the provider, one company can quietly play more than one of these roles.
Stripe is the classic all-in-one.
A single Stripe account bundles the gateway, the processor, and the merchant account together—the register, the courier, and the armored truck rolled into one payment service provider. That’s why Stripe is so fast to set up: There’s only one thing to sign up for.
Authorize.net works the opposite way. It’s purely a gateway—just the register—and you choose a separate payment processor and merchant account to sit behind it, often through your own bank or a merchant services provider you already trust.
Why does that contrast matter for nonprofits and their donors?
With the all-in-one model, convenience comes from one company controlling the whole chain.
With the separate-pieces model, you trade a little setup effort for the ability to shop around on rates and keep the relationships in your own name. Neither is “better” in the abstract—but they hand you very different amounts of control.
If a lot of this vocabulary sounds borrowed from retail, that’s because it is.
Payment gateways were built for e-commerce—an online store running ecommerce sales through its ecommerce platform, or a brick-and-mortar shop swiping cards on a point-of-sale system with a point-of-sale terminal at the counter.
Nonprofits inherited the same financial “plumbing,” so to speak, which is why your donation records often sync neatly into accounting software for reconciliation, and why you’ll sometimes hear an all-in-one provider described as a “payment aggregator”—a company that pools many organizations together under one master merchant account.
How does a payment gateway actually work?
The payment gateway encrypts and protects the data your donor puts in once they input payment details.
The moment your donor hits submit after entering their credit card number, the gateway wraps that cardholder information in encryption and creates a token.
This step is called “tokenization,” and it’s the same kind of secure socket layer (SSL) protection that puts the padlock symbol in your browser bar. That way, the credit card details aren’t readable. The gateway may also run fraud-protection checks here, like address verification systems (AVS), which compare the billing ZIP code the donor entered against the one on file with their bank.
Here’s something worth pausing on, because I’ll come back to it later in this article.
Tokenization. It’s a funny word.
And a trustworthy gateway doesn’t store the raw card number in your fundraising platform. Instead, it swaps the sensitive credit card details for a token—a random stand-in string that’s useless to a thief but lets you charge that same card again. The real card data lives in the gateway’s secure vault; your platform just holds the token. This is the heart of what’s coming in the next section.
What’s a recurring donation token—and where does it live?
This is the section I’d staple to the top of every “how to choose a fundraising platform” checklist if I could. It’s the piece almost no one explains, and it can quietly decide the long-term fate of your monthly giving program.
When a one-time gift goes through, the token I described above can simply be discarded. But a recurring gift is different. To charge a monthly donor $25 on the 15th, month after month, three things have to be stored somewhere and stay linked together:
- the donor’s information,
- the secure card or ACH token (the stand-in for their card or bank account—not the raw number), and
- the schedule that says “charge this token $25 on the 15th of every month.”
That bundle—donor, token, and schedule—is what I mean by a recurring donation token. The single most important question about it is: Where does that bundle of information live?
It can sit in one of two places:.
- Option A: The recurring details live in the payment gateway. The two main systems built for this are Authorize.net’s Automated Recurring Billing (ARB) and Stripe Billing. Both store the recurring payments—the token and the schedule—inside the gateway itself. The gateway keeps charging the card on schedule, on its own, whether or not any particular fundraising platform is connected.
- Option B: The recurring details live inside the fundraising platform. Some platforms keep the schedule (and effectively the control of the token) in their own system, then tell the gateway to charge the card each month. It works fine… right up until you try to leave. Because the moment you disconnect that platform, the instructions that fire those monthly charges go with it.
Why does that distinction matter? Because of what happens when you switch.
If your recurring donations live in a gateway you control, your monthly donors keep giving without interruption when you change platforms—the gateway just keeps doing its job. If they’re locked inside the platform, the only fallback is asking every monthly donor to re-enter their card on the new system.
In my experience, a meaningful share of them never do, and you lose recurring revenue you spent years building.
📚 One note on bank-based gifts: The same logic applies to recurring ACH (eCheck) donations, where the “card” is really a bank account on file. If you offer bank transfers as a giving option, ask the same “where does the token live” question about them. We cover the mechanics in our guide to ACH payment processing for nonprofits.
Why does this matter so much for nonprofits specifically?
Plenty of businesses run subscriptions, so why do I beat this drum harder for nonprofits?
Because recurring giving is disproportionately valuable to you… and disproportionately fragile.
Monthly donors are some of the most loyal, highest-value relationships your organization has.
The average monthly donor:
- Gives about $660 per year on the 4aGC platform
- Retains at rates up to 90%
- Has lifetime value of around $7,604.
That’s a predictable, budgetable base a small nonprofit can build everything else on. Lose a chunk of that base in a migration, and you’re not just changing software; you’re taking a real hit to next year’s budget.
Here’s the uncomfortable part. The Whole Whale podcast investigated donation platform policies and found that for roughly 25% of platforms, nonprofits can’t seamlessly migrate their recurring donors at all—because the recurring tokens are trapped inside the platform, not the gateway.
That’s the practical consequence of where your data lives.
A quick word on donor-tip based platforms, since the topic comes up constantly and it’s tied directly to gateways. Several popular “free” platforms run on a donor-tipping model, and many of them act as the merchant of record—meaning they’re the ones who own the merchant account and, often, the recurring tokens. Read The real cost of free fundraising software to learn more.
Those platforms have earned their place, and for a seasonal or one-off campaign they can be a perfectly reasonable starting point.
But it’s worth knowing the trade-off: When the platform is the merchant of record, you typically don’t own your recurring donor tokens, which is the same lock-in we’ve been describing. (One more reason to ask where the tokens live before you commit.)
📚 Go deeper: This gateway question is one slice of a bigger idea I care a lot about—see the pillar piece on donor data ownership for the full picture, and our overview of what to know about nonprofit payment processing before you choose a platform.
Which payment gateways do nonprofits usually use?
Once you know what a gateway does, the practical question is which one sits behind your donation pages.
Here’s an honest, non-exhaustive overview of the names you’ll see most. For a full head-to-head, I’ll point you to the deeper comparisons rather than rehash them here.
- Authorize.net. One of the most widely sold and supported gateways in the United States. Its big advantage for nonprofits is choice: Because it’s a pure gateway, you can shop around for the payment processor and rates behind it—through your own bank or a merchant services provider you already trust. Its Automated Recurring Billing keeps recurring tokens in the gateway. (It also offers an Advanced Fraud Detection Suite for risk management.)
- Stripe. A modern, developer-friendly, all-in-one option that bundles gateway, processor, and merchant account. It’s excellent for fast setup, digital wallets, and a clean checkout, and Stripe Billing keeps recurring details in the gateway. The nuance for nonprofits is how you’re connected to it—through Stripe Connect—which affects how much of the account you actually own. We unpack that in our guide to Stripe for nonprofits.
- PayPal. Familiar to donors and easy to offer as one of several alternative payment methods, which can lift conversion for supporters who’d rather not type a card number. Many teams offer it alongside a primary gateway rather than as their only one.
- Larger commercial gateways like Adyen and Worldpay show up mostly for big enterprises and high-volume international payment gateways with multi-currency support. They’re usually more than a small to midsize nonprofit needs, but you may see the names, so they’re worth recognizing.
A few features that distinguish gateways from one another, and I’m happy to talk through them with you in a free payment processing audit. Set up a meeting here and let me know you’re interested in an audit before you hit send.
📚 Want the full comparison? For a side-by-side on the two gateways most nonprofits actually choose between, see Authorize.net vs. Stripe for nonprofits.
