Virtual cards are debit card numbers that can be issued to OSC's hosted initiatives for paying online for things like: recurring payments, utility bills, online resources/tools, subscriptions, vendors (e.g. wholesale distributors), etc. They are directly tied to collectives' budget on the Open Collective platform.

How it works:

Funds are spent only as transactions occur. (Setting up a card does not remove any money from your initiative's budget.)
Submit a virtual card request with the intended use of the card (please specify the names of the services you will use) and the amount budgeted for that use monthly (e.g. $300/monthly). The virtual card with that limit will be set up for your collective.
If your collective needs a higher limit on your virtual card please request a limit increase by contacting us at hello@oscollective.org with the intended use and the amount increase needed.
To receive an increase, initiative must have a budget on their Open Collective account that exceeds the corresponding amount, and must demonstrate that a higher limit is necessary.
Cards must be used in compliance with our policy below.

Requirements/Policy:

Initiatives must have a minimum of 2 admin members
These are virtual cards. No physical card will be issued, so these cannot be used in-store.
All transactions should comply with normal usage of initiative funds as outlined in our Terms of Fiscal Sponsorship

Limitations:

Virtual cards may not be used for paying/reimbursing people, that should be done on the OC platform.

If you need to input Cardholder contact details/address:

Name: Open Source Collective
Address: 440 N Barranca Ave #3939 Covina, CA 91723, USA

Steps:

Setup the card:
Initiative admins request the card from OSC:

Visit your initiative's page
Click Actions -> Request a Card
OSC will assign the card (please allow time for processing)
Once assigned, the card assignee will be notified via email and the card's details will appear in the initiative's Settings for you to use (in accordance with this policy)

After a purchase is made:

The funds will be withdrawn from your initiative

An "Invitation to submit an expense" will be sent to your initiative admins
Admins will be asked to submit your receipt. (If the receipt is not submitted within 30 days, the card access will be paused until you do submit the receipt).

Janne Uusitupa

Contributions

Budget

Bug bounty for a shell injection vulnerability (CVE-2021-32692 / GHSA-3x6w-q32m-jqf3)