Nonprofit Donor Data

A development office runs on one database and a very small team. Someone will paste a segment into a chat window to get a faster draft. The donor record was never meant to travel that way. This starter narrows what can leave and refuses the request that asks for the whole list.

Fundraising teams handle two risks that rarely appear together. One is quiet exposure of a donor identity inside a prompt sent to a vendor model. The other is a request that tries to pull a whole list out at once. This chain is short and aimed at both.

Six controls run, and only output scoring works on the returned text. Injection screening leads. An access rule refuses a caller with no verified identity, even without custom roles in place. Donor number patterns are masked next. A block list then rejects any request naming a bulk donor export, a beneficiary raw file or a private key.

Output scoring is the single response side control. The combined floor is 0.78, with relevance at 0.78 and accuracy at 0.80. A reply under 120 characters or shorter than two sentences fails as well, and the default action is refusal. That setting suits a donor letter draft more than a research summary.

Notice what is absent. No source checking runs, so a generated donor history is never measured against supplied context. No review point exists, which means nothing escalates to a person inside this chain. No history capture is configured either, so request and response retention stays entirely your decision. Audit marking records an allow signal and never blocks, and it builds no archive of its own. Pick the Humanitarian Aid starter when beneficiary case files, bias review and redacted history matter more than donor privacy alone.