ARO is the platform where an aid organisation records who it assists and where every unit of money went. Coordination and finance work from the browser. The field team records from the phone, with no signal.
The platform
Coordination opens the browser. The field team takes out the phone. A sponsor gets a link. All three look at the same database.
Coordination, finance and management. Records, programmes, advances, settlements, permissions and the sponsor panel. Nothing to install.
The team that goes out. It registers people, deliveries, photos with location, signatures and audio with the phone in hand. It runs with no signal.
A sponsor opens their own link from a phone and sees updates about the person they support. No username, no password.
The problem
A beneficiary management app does not solve this. It hides it.
Following someone for years who has no ID, whose name is transliterated differently every time, and for whom the record itself is a risk. The requirement is the least data possible and the most secrecy.
Following every unit of money from the donor down to one concrete delivery, and returning it as a settlement. The requirement is the most detail and demonstrable evidence.
What it does
The target population has no ID card, uses aliases and has an estimated date of birth. A person is a record with several weak identifiers, none of them mandatory. In the field the one that works is an internal code with a QR printed on a card. Duplicates are proposed with a score and decided by someone on the team. The system never merges on its own.
Offline writing is complete: people, deliveries, follow-ups, photos, signatures and audio. Reading is limited on purpose. Downloading the full record of persecuted people onto a phone opens a risk. The device pulls only the people assigned to that user, and the cache purges itself after the configured number of days. Critical fields never come down.
In a field operation most expenses have no receipt. Demanding one produces empty fields and people who invent data to be able to save. In ARO a cash advance is handed over, every expense draws down that balance, and at closing the balance reconciles against what was settled plus the cash returned. A shortfall shows up when the advance is closed.
Someone dictates “bought 40 kilos of rice for the Ahmed family, 6,500 rupees” and gets back a draft with amount, currency, category, beneficiary and fund. The original audio is stored immutably and is the primary record. Every field the model inferred stays flagged until a human confirms it. Balances and approvals are computed by code.
A social follow-up may describe a pregnancy resulting from violence, and that text lives in the social module. The confidentiality level is a property of each field and each attachment. The screen is assembled from what that person is allowed to see. Critical fields are encrypted with a per-organisation key and every read is audited.
The real record does not leave the system. A sponsor sees a short profile written by the organisation, with a public name, an age and a few lines of story. The database rejects a public name containing the real name. A person flagged as protected is never published. A photo of a minor needs the signature of a second person on the team.
Protection
They bounce the same way from the app, from the browser and from a hand-written query.
Religion, trafficking risk and exact location live in a table that never syncs to the device.
Nothing is physically deleted. To erase a critical value its encryption key is destroyed. The accounting entry stays.
Whoever writes an update does not approve it. An approved update is frozen. A confirmed expense is corrected with a counter-entry.
A sponsor enters with no username and no password. The link expires and can be revoked. The database keeps a 64-character fingerprint.
Data lives in the European region, outside the country where the programme operates.
The donor page exposes no internal identifier. An automated check inspects every response.
Where it came from
The first deployment supports 31 people freed from debt bondage. Every decision came from a problem that showed up there: people without documents, phones without signal, expenses without receipts, real risk if one piece of data is published. For the safety of those people we do not publish the country, the city or the name of the organisation.
Pricing
The per-user price counts whoever signs in to the platform. Sponsors who open their own page are not users.
Free · shared database
Dedicated database
Dedicated database with AI
The assistant
The third plan includes an assistant that works across the whole system. You ask, and it answers with the organisation's real data.
Balances, thresholds and approvals are still computed by code. The assistant queries and drafts.
Get started
Free sign-up waits for nobody. If you would rather we walk you through it first, leave your details.
You can also download the Android field app. Google Play