ARO is the platform where an aid organisation records who it assists, where every unit of money went, and shows it to whoever funds the work. Field teams use it with no signal.
The problem
A beneficiary management app does not solve this. It hides it.
Following someone over years who probably has no ID, whose name is transliterated differently every time, and for whom the record itself is a risk. It needs the least data possible and the most secrecy.
Following every unit of money from a donor down to one concrete delivery, and back as a settlement. It needs the most detail and demonstrable evidence.
What it does
The target population has no ID card, uses aliases and has an estimated date of birth. A person is a record with several weak identifiers, none of them mandatory. The identifier that actually works in the field is an internal code with a QR printed on a card. Duplicates are proposed with a score and decided by a human. The system never merges on its own.
Offline writing is complete: people, deliveries, follow-ups, photos, signatures and audio. Reading is deliberately limited, because full offline reading about persecuted people is a risk rather than a feature. The phone downloads only the people assigned to that user, and the cache purges itself after the configured number of days. Critical fields never come down.
In a field operation most expenses have no receipt. Demanding one produces empty fields and people who invent data to be able to save. In ARO a cash advance is handed over, every expense draws down that balance, and at closing the balance has to reconcile against what was settled plus the cash returned. Poor accounting shows up without a single piece of paper.
Someone dictates “bought 40 kilos of rice for the Ahmed family, 6,500 rupees” and gets back a draft with amount, currency, category, beneficiary and fund. The original audio or text is stored immutably and is the primary record. Every field the model inferred is flagged as inferred until a human confirms it. Balances and approvals are computed by code, never by the model.
A social follow-up may describe a pregnancy resulting from violence, and that text lives in the social module. So the confidentiality level is a property of each field and each attachment, and the screen is assembled from what that person is allowed to see. Critical fields are encrypted with a per-organisation key, and every read is audited like a write.
The real record never leaves the system. A sponsor sees a short profile written by the organisation, with a public name, an age and a few lines of story. The database rejects a public name that contains the real name. A person flagged as protected is never published. A photo of a minor needs a second signature from a different member of the team.
Protection
They bounce the same way from the app, from the admin panel and from a hand-written query. A shortcut in the code does not skip them.
Religion, trafficking risk and exact location live in a separate table that never syncs to the device. A lost phone does not carry them.
Nothing is physically deleted. To truly erase a critical value its encryption key is destroyed: the accounting record stays, the content is unrecoverable.
Whoever writes an update does not approve it. An approved update is frozen and is never edited afterwards. A confirmed expense is corrected with a counter-entry, not by editing it.
A sponsor opens their page with no username and no password. The link expires, can be revoked, and is stored nowhere: the database keeps a 64-character fingerprint of it.
Data lives in the European region, outside the country where the programme operates. In a rescue operation that is not a technical preference: it is the physical safety of the people.
Not one internal identifier of a person, programme or organisation is exposed. An automated check inspects every response and fails if one ever slips through.
Where it came from
The first deployment supports 31 people freed from debt bondage. Every decision in this product came from a problem that showed up there: people without documents, phones without signal, expenses without receipts, and a real risk if one piece of data is published. For the safety of those people we do not publish the country, the city or the name of the organisation.
Plans
Shared database
Dedicated database
Get started
The app is free and sign-up waits for nobody. If you would rather we walk you through it first, leave your details and we will arrange a demo.