Are group card websites safe? A practical checklist
On this page
Quick answer: Group card websites are generally safe to use if you check a few basics first: the site uses HTTPS, payments go through a recognised processor, there's a clear privacy notice naming the company, and links are shared only with the right people. Avoid uploading sensitive personal details, and keep a PDF copy of the finished card.
Before you paste a signing link into the team chat, it's sensible to ask where those messages, names and photos end up. This guide gives you a checklist you can apply to any group card site, explains what UK data protection law means for you, and is upfront about what SignThisCard does and doesn't do.
What makes a group card website safe?
A safe group card website protects data in transit, handles payments through a trusted processor, explains how it uses personal data, and gives you control over who sees the card. No website can promise zero risk, so it's also about how you use it.
If you're new to online cards, our guide to making a group card online explains how the signing and sending process works, which makes the security points below easier to follow.
The group card safety checklist
Run through these points before you sign up for any site, whether it's SignThisCard or another provider.
1. Check for HTTPS
The address should start with https://, and your browser should show a padlock or similar icon. HTTPS encrypts the connection between your device and the site.
But the padlock isn't a seal of approval. The UK's National Cyber Security Centre (NCSC) points out that a padlock doesn't guarantee a retailer is legitimate, and that fake sites can copy real designs and use lookalike web addresses. Check that you've typed or clicked the correct address.
2. Check who handles payments
A safe site shouldn't need to store your card details itself. Look for a recognised payment processor at checkout, such as Stripe or PayPal.
SignThisCard takes payments through Stripe's secure checkout. Card details are handled by Stripe and are not stored by SignThisCard. Stripe states in its own documentation that it is independently certified as a PCI Level 1 Service Provider, the highest level under the card industry's security standard.
The NCSC also suggests paying by credit card where you can, because of the extra protections it can bring.
3. Read the privacy notice
A trustworthy site should have a privacy notice that tells you:
- Which company is responsible for your data
- What personal data it collects, and why
- How long it keeps data, or how it decides
- How you can ask for access or deletion
- How to contact the company
SignThisCard is owned by Williation Ltd, a UK company, and its privacy notice sets out how personal data is handled. It doesn't publish a fixed number of days for how long cards stay online; retention is assessed against the continuing purpose of the card and account. Our article on how long a group card stays online covers this in more detail.
4. Understand how links work
On most group card sites, the link is the key. On SignThisCard, anyone with a signing link can add a message, and anyone with a finished-card link can open the card.
That's convenient, but it means you should:
- Share the signing link only with the people you want to sign
- Keep the management link private, as it controls the card
- Avoid posting links on public social media or open forums
- Use individual invitation links if you want each person to have their own link (each personal link accepts one signature)
5. Check what signers have to give
Fewer accounts means less personal data collected. On SignThisCard, signers don't need an account; they just add a message and a name. Only the organiser creates a free account and verifies their email before sharing or sending. Our guide on signing a group card without an account explains how this works.
6. Look for anti-abuse measures
Sites that accept messages from anyone with a link should take steps against spam and bots. SignThisCard uses reCAPTCHA v3 and email verification for organisers. The organiser can also remove messages before the card is sealed.
7. Check you can keep a copy and ask for deletion
A good site lets you keep the card. On SignThisCard, the print view offers "Download PDF", so the recipient can keep a copy. You can contact support to ask for deletion.
What does UK GDPR mean for group cards?
UK GDPR gives people rights over their personal data, including the right to ask for it to be deleted. The Information Commissioner's Office (ICO) is the UK regulator responsible for data protection.
Key points for organisers and signers:
- Right to erasure: You can ask an organisation to delete your personal data. The ICO explains that this right isn't absolute and depends on the circumstances.
- Response time: Organisations generally have one month to respond to a data protection request.
- Complaints: The ICO expects you to raise a complaint with the organisation first. If you're not satisfied, you can then complain to the ICO, though it doesn't award personal compensation.
If you're in the US, the same checklist applies, and the site's privacy notice remains your main guide to how it treats your data.
What shouldn't you upload to a group card?
Don't upload anything you wouldn't be comfortable with everyone holding the link seeing. A group card is a friendly message, not a secure document store.
Avoid adding:
- Home addresses, phone numbers or personal email addresses
- Health details, such as a diagnosis in a get-well card
- Bank details, passwords or ID documents
- Confidential work information, client names or figures
- Photos of other people, especially children, without their (or their parents') permission
- Screenshots of private chats
If you're collecting money for a gift, keep that separate. SignThisCard doesn't collect money, so link to a separate method, such as a bank transfer or gift-collection service, in your invite message rather than posting bank details on the card.
How do you compare the safety of different group card sites?
Use the same checklist for each site and note what each one publishes. Here's a quick comparison template:
| Check | What to look for |
|---|---|
| HTTPS | https:// and the correct domain |
| Payments | Recognised processor; site doesn't store card details |
| Company | Named company with contact details |
| Privacy notice | Clear purposes, retention approach and rights |
| Link control | Separate signing, viewing and management links |
| Signer data | Whether signers must create accounts |
| Moderation | Organiser can remove messages |
| Keepsake | Download or print option |
For a wider comparison of features and pricing, see our roundup of the best group card websites. If you're worried about paying for the wrong plan, our guide to group card refunds explains your rights.
Key takeaways
- Group card websites are generally safe when they use HTTPS, a recognised payment processor and a clear privacy notice.
- A padlock shows the connection is encrypted, not that the site is legitimate, so check the web address too.
- SignThisCard uses Stripe for payments, and card details are not stored by SignThisCard.
- Anyone with a signing or finished-card link can open the card, so share links only with intended people.
- UK GDPR gives people the right to ask for deletion, and the ICO handles complaints after you've raised them with the organisation.
- Never put addresses, health details, bank details or confidential work information on a group card.
Frequently asked questions
Is SignThisCard safe to use?
SignThisCard uses HTTPS, reCAPTCHA v3 and email verification for organisers, and takes payments through Stripe, which handles card details. Signers don't need an account. As with any link-based card, safety also depends on sharing links only with intended people and not uploading sensitive information.
Can strangers see my group card?
Only if they have the link. On SignThisCard, anyone with a signing link can add a message and anyone with a finished-card link can open the card. Don't post links publicly, keep the management link private, and use individual invitation links if you want more control over who signs.
Do signers have to give personal information?
On SignThisCard, signers don't need an account. They add a message, a name and, optionally, a drawn signature or a photo. Whatever they type becomes part of the card, so they should only include what they're happy for the recipient and other link holders to see.
Does SignThisCard store my card details?
No. Payments are processed by Stripe through a secure checkout, and card details are handled by Stripe rather than stored by SignThisCard. You can read more about how personal data is handled in the SignThisCard privacy notice, and Stripe publishes its own security information.
How do I get my message or card deleted?
The organiser can remove messages from a card. For deleting a card or account data, contact SignThisCard support. Under UK GDPR you can ask an organisation to erase your personal data, although the right isn't absolute. If you're unhappy with the response, you can complain to the ICO.
Is it safe to add photos of children?
Only with permission from their parents or guardians, and only if everyone with the link is someone you'd trust with that photo. In our view, for work cards it's usually best to avoid children's photos altogether, unless the parent has added the photo themselves.
What should I do if I think a group card site is a scam?
Don't enter payment details. Check the web address, look for a named company and contact details, and search for independent reviews. The NCSC accepts reports of suspicious websites in the UK. If you've already paid, contact your bank or card provider promptly.
Conclusion
So, are group card websites safe? Most reputable ones are, provided you check for HTTPS, a recognised payment processor, a clear privacy notice and sensible link controls, and you keep sensitive details off the card. Use the checklist above on any site you're considering.
If you'd like to put SignThisCard to the test, read through its privacy notice, then start a group card on SignThisCard when you're comfortable.