We only touch 4 piles of stuff

Money totals, kid head-counts, and our worker list have no people's names in them.

Only ONE box has real donor names + mailing addresses — the "Thank-You Card" box.

That name-box is small, locked, and emptied fast

Names go in only to print thank-you cards, then get swept out — we keep just a number, not the name.

Every group gets its OWN cave

Each client's stuff lives in its own separate database. Nothing gets mixed together.

Locks on everything

Data is scrambled with locks both while it travels and while it sits still. Keys & passwords are locked away too, never written in the code.

The AI NEVER eats the data

We never feed the ministry's data to any AI to train it. The robot just points at what to do — the plain code carries the data. The data never goes inside the AI's head.

Bad guy sneaks in → alarm + slam the door + tell the chief

Every touch of the name-box is written in a logbook. Trouble? We lock the doors instantly and promptly tell the client what happened, when, and what was involved.

We carry a shield + a rulebook

Real insurance (Errors & Cyber, up to $1M) and a written company policy for how client data is handled, stored, and thrown away.

What we're making even stronger next

Coming upgrades: build stone bridges of code so the AI never even touches the data · put names in a locked chest (field-level encryption) · hold our own keys · practice the escape drill (tested restore) · change the locks every moon (monthly).

The BIG lesson 🧠

Locked-up data is safe while it sits still. The danger is when good people need to use it and there's no safe tool — so they sneak it out the back into free chatbots. Any team would do it.

So we build a safe road

Now the stuff is SAFE and USABLE.

Staff get what they need through a safe, code-driven road — so nobody has to sneak. (For everyday office stuff, in-house Microsoft Copilot is the safe helper.)