Ethics commitments

What this page is

This is the public version of the ethical framework that governs how Guardians of the AV is built and operated. It is written for journalists, county counsel, lived-experience advisors, and partner-organization leadership. It is meant to be quoted back to us. Where a commitment is already enforced by code, schema, or contract, we cite the file or commit. Where a commitment depends on work we have not yet shipped, we name the phase honestly. The companion documents are the privacy policy, the docs/legal/founding_charter.md in the repository, the partner data-processing agreement template, and the data-processing posture brief.

What we won't do, ever

These are non-waivable structural commitments. They cannot be relaxed by an operator, a donor, a partner organization, a board member (when there is a board), or a government request. Several are enforced in schema and row-level security, not just in policy.

We will never become a controller of domestic-violence-survivor case data.

Routing to the domestic-violence agency and the Family Justice Center is referral-only. Their VAWA-comparable database operates at their boundary, not ours. Our schema contains no DV-survivor classification fields and no admin role with the ability to create one (founding charter §3.6).

We will never hold protected health information without a Business Associate Agreement.

Healthcare-adjacent data flows only when there is a signed BAA under HIPAA and the applicable HITECH rules. Until a BAA is executed with a specific covered entity, PHI does not enter the system (founding charter §3.4).

We will never use peer attestation for trust progression.

Only partner-organization staff with role='partner_admin' on a verified partner record can verify completion of an earning event. No self-report. No "rate this person." This rule is enforced at the database boundary via row-level security and at the application boundary in /partner/issue.

We will never sell, license, or share user data with third parties for marketing.

California Privacy Rights Act opt-out is shipped and described in the privacy policy. We hold to a stricter standard than the legal floor: no sale, no licensing, no cross-context behavioral advertising, no "data partnerships" that move user records off our systems.

We will never operate as a surveillance layer for law enforcement.

We do not respond to non-warrant law-enforcement requests for user data. If we are served with a warrant, the impacted user receives notice unless the warrant prohibits it. Reference baseline: the Electronic Frontier Foundation's "Who Has Your Back" criteria.

We will never run experiments on users without disclosure.

A/B tests on trauma-informed surfaces require ethics-board sign-off. The ethics advisory board does not exist yet — it is a Phase 1.5 commitment described below. Until the board is seated, no experiments run on trauma-informed surfaces, full stop.

A note on the difference between operational logs and experiments. Our host (Vercel) records edge request logs to route traffic — URL paths, response times, IP addresses needed to deliver a packet. That is how a content-delivery network works; it is not an experiment and it is not behavioral analytics. What we will not do, and have not done, is install client-side analytics tools that would let us measure user behavior in a way that could fuel A/B tests or experiments. Vercel Web Analytics, Vercel Speed Insights, and Google Analytics are deliberately absent from this site. The full disclosure of what our host sees lives on /privacy under "Hosting and infrastructure." If we ever change that, the change goes through ethics-board review and gets disclosed here first.

What we will do, by default

The dignity floor is opt-out, not opt-in. These behaviors are the default for every user on every surface; a person never has to ask for them, qualify for them, or disclose anything about themselves to receive them.

• Trauma-informed default register on every public surface: predictable language, no-blame framing, no forced disclosures (founding charter §3.7, standard set by Anadora Turner, MSW, USC).
• Crisis lines visible from every page footer: 988, Mobile Crisis, DV hotline, National DV.
• Safety-exit one tap from every page — leaves the site and overwrites the visible history entry. On mobile the tab-switcher snapshot and the device's URL-suggestion cache are outside this site's reach; the residual gap is walked through honestly on /privacy so a person on a monitored device can decide what level of caution they need.
• Anonymous Tier 0 — the resource map at /map works with no account, no phone number, no ID.
• Auto-deletion of in-flight coordination-packet wizard data after 30 days (Supabase TTL, commit 78743c4).
• Audit-trail logging on every admin action via the user_role_grants table.
• Public transparency: live counter at /today, redacted Anadora field-interview ledger at /phase-0-ledger.

Abuse vectors we've thought about

A coordination platform that mints credits, accepts donations, and routes vulnerable people creates real attack surfaces. The list below is not exhaustive, but it is honest: each item names the vector, the mitigation we have shipped, and the gap that is still open. Phase labels (1, 1.5, 2, 2+) reflect when we expect to close each gap; they are not aspirational.

1. Sybil attacks on meal credits. A single person creates five accounts to harvest credits.

   Mitigation: partner-attestation requirement for credit issuance (no self-mint), phone-OTP rate-limiting on signup, Stripe-side donation deduplication.

   Gap: no behavioral-anomaly detection on signup/redemption patterns (Phase 1.5).

2. Partner-staff collusion. A partner-admin issues fake attestations to a confederate.

   Mitigation: append-only audit log on every issuance event, a 30-day window before credits can be redeemed at scale, future partner-rotation review by Anadora's field-validation pass.

   Gap: no automated collusion-detection model that flags issuance/redemption pairs (Phase 2).

3. Donor-side fraud / chargeback laundering. A bad actor donates with a stolen card, the donation funds credits, the credits are redeemed, the original card is chargebacked.

   Mitigation: Stripe handles chargeback processing end-to-end, 7-day hold on credit-issuance from new donors under a velocity threshold.

   Gap: no donor-fraud-scoring model that ties payment signals to credit-issuance rate (Phase 2+).

4. Coordinated harassment via the help-request system. A user is targeted by a bad actor filing false help-requests on their behalf.

   Mitigation: phone-OTP gate on help-request creation, partner-staff review queue before any broadcast, no public listing of help requests by name.

   Gap: no user-side block list — a target cannot pre-emptively prevent a known harasser from filing requests about them (Phase 1).

5. Re-identification of confidential resources. Someone tries to derive SafeQuest's street address from quasi-identifiers in resource queries.

   Mitigation: confidential=true flag on the resource row, RLS policy strips the address field entirely on read, no geo coordinates exposed for confidential rows in any API surface.

   Gap: no rate-limit on metadata queries against confidential rows — a determined adversary could still mine category/hours data (Phase 1.5).

6. Identity fraud via wizard PDF abuse. Someone fills out a General Assistance wizard using another person's identifying information.

   Mitigation: applicant signature pad on the generated PDF, in-person handwriting at the county appointment, Option A skip-and-handwrite SSN path (commit 66aa35c) so the platform never has to hold the SSN.

   Gap: no live-identity-proofing step — the wizard does not verify that the typed name matches a real person (Phase 2+).

7. Partner-DPA breach (PII leaked from partner side). A partner exports user data to their own systems against the data-processing agreement and the data subsequently leaks.

   Mitigation: the contract clauses in docs/legal/partner_data_processing_agreement_template.md bind the partner to a 72-hour breach-notification window and a revocation right we can exercise on the platform side.

   Gap: no DLP (data-loss-prevention) scanning on partner exports — we trust contract enforcement, not technical egress controls (Phase 2+).

Who watches us

Accountability is layered, and several layers are not yet in place. We name them here so they can be checked against reality.

• Lived-experience advisors. Paid honoraria (US$200/month per advisor under the Phase 0 plan), at least two seated by Phase 1. Their role is to flag where the platform feels coercive, surveillance-adjacent, or dignity-eroding — before journalists or county counsel ask the same question.
• Anadora Turner, MSW (USC). Clinical co-lead, authority on the dignity floor and the trauma-informed register (founding charter §3.7, §4.1).
• Outside counsel. A California nonprofit attorney is engaged for the 501(c)(3) formation. Ongoing privacy review is scoped for Phase 1.
• Ethics advisory board. Phase 1.5. Composition: clinicians, lived-experience advisors, and civil-liberties advocates. Sign-off authority over the A/B-testing commitment above and over material changes to this page.

Where to report concerns

• General: hello@guardiansofsolano.com
• Privacy: privacy@guardiansofsolano.com
• Security disclosures: security@guardiansofsolano.com — see the full coordinated-disclosure policy at /security.
• Anonymous concerns: a whistleblower channel at /docs/whistleblower is in scope for Phase 1.5. In the interim, written concerns can be addressed to outside counsel via the general inbox with the subject line Confidential — for counsel.

How this page changes

Material changes to this page are recorded in git history at apps/web/app/ethics/page.tsx and, once the ethics advisory board is seated (Phase 1.5), require board sign-off. Until then, both founders (Aaron Turner and Anadora Turner) must jointly approve any change that weakens a commitment. New commitments can be added unilaterally; existing commitments cannot be removed or softened without a written record of why.