Where Your Data Travels — A Map

A plain-language picture of where each pull of data came from, who touched it along the way, and where it lives now — drawn as castles, roads, and bridges.

The pieces, in plain words

Cloudflare = our castleA big cloud provider that hosts our tools. Think a moated, gated castle: walls, guards, and no ordinary doors (no servers to break into). Each client gets its own castle — nothing shared.
API = a covered bridgeA narrow, guarded path where code carries the data directly, sealed from view. The AI can tell the guards what to fetch, but never rides along and never sees the treasure.
Locks = encryptionThe data is scrambled with a lock both while it travels (TLS) and while it rests (AES-256). Without the key it's gibberish.
The AI = a helper, not a keeperToday: it helps carry the load, but is opted out of training (it doesn't learn from your data) and holds nothing beyond 30 days. The fix: it moves to the tower and only directs — code carries the treasure, the AI never sees it.

1 · The Workday pull staff & assignments — no donor or student names

Workday castle ⚠ open road today carried in — AI helps, opted out of training Cloudflare castle the fix: covered bridge ✅ code carries it · AI never sees it
Where it came from: Workday — staff roles, reporting lines, work phone, IV employee ID, cost center. Internal identifiers only; no donor or student names.
Who touched it: our sync + (today) the AI layer, which is opted out of training. Cloudflare hosts it; Anthropic is the AI provider.
Where it went: its own isolated, encrypted database. Used only to match records (line up income to the right part of the ministry). Never displayed in any screen.
The fix → a covered-bridge API so staff/assignment syncs move by code and the model is never in the path.

2 · The Salesforce pull for Thank-You cards the one place with donor names

Salesforce castle 👑 the treasure (real names) only to print thank-you cards Card Tracker vault names swept out after cards → only a donor-ID stays
Where it came from: a Salesforce donor report — real donor names and mailing addresses. This is the only place personal names are present.
Who touched it: gated to logged-in staff with per-user roles; every touch is written in a logbook. Today the movement still passes the AI layer (opted out of training); instant kill-switch if trouble.
Where it went: a temporary, guarded vault — long enough to print thank-you cards, then purged to a plain donor-ID. The names don't stay.
The fix → covered-bridge API so names move by code and never enter the AI, plus a locked chest (field-level encryption) so even opening the vault wouldn't reveal them.

3 · The Salesforce pull for shared-account income totals only — no names

Salesforce castle $ $ $ just totals — no names Cloudflare castle lowest-risk pull ✅
Who touched it: same isolated, encrypted castle; this is metadata, not personal information, so there's no name to protect in the first place.
Where it went: the CRM as totals/metadata. Nothing to age out or purge because there's no personal data in it.
The fix → same covered-bridge API, for consistency — every systematic move runs by code, off the open road.
The whole plan in one line: today the treasure travels an open road and a helper carries it; we're building covered bridges (guarded API paths) between the Salesforce & Workday castles and our Cloudflare castle, so the data moves by code, out of sight — and no bandit, and no AI, ever touches it in transit.
Drawn from HalyardCo's written data-practices document. A plain-language picture, not a change to the practices themselves.