How AI4Love Handles Nonprofit Data Security

AI4Love maintains one bounded working base per organization to run its nightly analysis, held in AI4Love's Airtable account and isolated from every other organization's. It holds only the normalized activity records and insights the nightly analysis requires. It exists while your service is active plus a 90-day exit window, then it is deleted; a full export or immediate deletion is available on request at any time. A nightly sync to a file your organization owns is designed and available to be provisioned per organization; it is not yet running in production, and we will describe it in the present tense only once it is.

If you disconnect AI4Love, your source systems are untouched. The working base enters a 90-day exit window during which you can request reactivation, a full export, or immediate deletion; after 90 days it is deleted.

Bounded Retention Architecture

AI4Love holds one working Airtable base per organization in AI4Love's account as a service provider. The base is isolated per organization. It exists only while service is active plus a 90-day exit window, then it is deleted. Full export is available on request. The client organization remains the institution responsible for the personal information under FIPPA. An organization-held mirror (Owned Copy) is designed but not running in production and is described only as planned.

Source systems stay the systems of record. What AI4Love holds is bounded, isolated, exportable, and deleted when you leave. The model extends across the stack:

Source systems (Blackbaud, Mailchimp, Environics): Read-only integrations. AI4Love never writes back to your source platforms.
Working base (Airtable, AI4Love's account, isolated per organization): AI4Love writes only AI-generated insight records, enrichment fields, and campaign-workflow metadata through scoped application code. Deleted after the 90-day exit window.
LLM providers (Anthropic, OpenAI): API-tier usage only. Neither provider trains on your data. Inputs are retained up to 30 days for trust and safety, then deleted.
Credential stores (Nango, Doppler): Hold access tokens, not supporter data. Revocation destroys tokens immediately.

Encryption Standards

All data is encrypted at every layer:

Layer	Standard
Data in transit	TLS 1.2+ — all API calls, webhooks, OAuth flows, MCP queries
Data at rest (Airtable)	AES-256
Data at rest (Nango credential vault)	AES-256
Data at rest (Doppler secrets manager)	AES-256
Data at rest (Vercel)	AES-256

No plaintext connections are accepted anywhere in the system.

What AI4Love Does NOT Process

AI4Love processes supporter engagement data: donation history, volunteer activity, event participation, and communication records.

AI4Love does not require and does not process:

Protected health information (PHI)
Financial account numbers, credit card data, or banking details
Government-issued identifiers (SIN, SSN, driver's licence)
Biometric data

If your Airtable base contains fields outside the engagement data scope, AI4Love applies allow-list field filtering before passing data to any sub-processor.

Per-Organization Data Isolation

Every organization gets its own dedicated Airtable base, its own credentials, and its own access keys. There is no shared tenancy at the data layer. A user authenticated for one organization cannot query another organization's data under any circumstances.

Credential Storage and Revocation

OAuth tokens are stored in Nango (SOC 2 Type II certified). AI4Love servers never persist tokens to disk.
API keys are stored in Doppler (SOC 2 Type II certified). Keys are never committed to code or logs.
Revocation is immediate. Staff can disconnect any integration from the dashboard. MCP access keys are validated on every request — revoking a key takes effect on the next request.

Infrastructure Partners

All sub-processors maintain SOC 2 Type II certification:

Provider	Role
Airtable	Data storage
Vercel	Application hosting
Nango	OAuth credential management
Doppler	Secrets management
Anthropic	LLM provider (Claude API)
OpenAI	LLM provider (ChatGPT API)

AI4Love does not currently hold its own SOC 2 Type II certification. All data storage and processing is delegated to SOC 2 Type II certified providers.

Incident Response

Phase	Timeline
Detection	Continuous automated monitoring
Containment	Within 4 hours
Notification	Within 72 hours of confirmed breach
Investigation	Within 7 days
Remediation	Within 14 days

Data Residency

All infrastructure is US-hosted. Canadian data residency is not currently available.

For full technical details, see the AI4Love Trust Center.

Common Questions

Does supporter data leave my environment? Yes — transiently, to API-tier LLM providers that do not train on it and delete inputs within 30 days. MCP can be disabled entirely if your privacy posture requires it.

Could PII persist in logs or memory? Memory is transient (serverless functions, under 30 seconds). Logs contain request metadata only, not PII. Vercel retains logs for 1 hour; SIEM streaming is available for 30-90 day retention.

Could a compromise corrupt my database? AI4Love connects with Editor permissions (not Owner). Application logic restricts writes to insight and enrichment fields only. Airtable's trash recovers deleted records for 7 days and deleted bases for 30 days; restore-only snapshots are retained up to 2 years and never queried by AI4Love.

What happens if AI4Love shuts down? Your source systems are untouched. A full export of the working base, including every insight generated for you, is available on request at any time; the base itself is deleted after the 90-day exit window. Nothing is locked in AI4Love's systems.

Is disconnection instant? MCP keys are checked per-request (no session). OAuth access tokens have a maximum 60-minute TTL; refresh tokens are destroyed immediately on revocation.