The Guardian Standard
Technology that serves people without surveilling them.
The default version of 'tech for homelessness' is a surveillance database — one that catalogs people, gets breached, and harms those it was meant to help. We refuse to build it. This is the standard we hold ourselves to, published so others can too. Any organization building technology for unhoused neighbors may adopt it.
Build no database that identifies the people you serve — no biometrics, no facial recognition, no master person-record.
Why
A firm that sold police facial recognition to identify unhoused people was breached, spilling photos and Social Security cards. Data you never collect cannot be stolen. Vice (opens in a new tab)
Verify
There is no table whose rows are people.
Never store a label or category about a person — not their sleeping status, their history, their diagnosis, their risk.
Why
Federal homeless-tracking databases were warned, two decades ago, to be 'a system of tracking similar to those imposed on individuals convicted of crimes.' Tracking people by condition is how stigma becomes permanent. EPIC (opens in a new tab)
Verify
No field classifies a person.
Measure what was funded and what was delivered as counts, not case files.
Why
Humanitarian aid at the scale of the Red Cross proves accountability 'without generating databases with recipients' data.' If you can show your impact, you can show it without a list of names. ICRC-collaborated research (opens in a new tab)
Verify
Every metric is a sum; none can be traced to an individual.
Domestic violence, immigration status, health, criminal history — connect people to specialized help off-platform, and store nothing about it.
Why
The safest record is the one that was never created. A breached list of DV survivors can get someone killed.
Verify
These categories exist nowhere in your data model.
Survival information — where to find water, a restroom, a warm room, a crisis line — requires no account, no ID, no signup.
Why
About 94% of unhoused adults have a phone, but connectivity lapses and accounts tied to a lost device strand people. Help gated by identity excludes the people who need it most. Shelterforce (opens in a new tab)
Verify
The core resources load for an anonymous visitor.
Default to the minimum data, with an automatic expiry.
Why
Data you don't hold can't be breached, subpoenaed, or sold.
Verify
Every stored field has a stated retention window and a purge that runs.
'Neighbors,' 'the unsupported' — never 'the homeless' or 'clients.' No shame-coded gates ('are you homeless?').
Why
Design signals respect or shame, and that changes whether someone walks through the door.
Verify
No copy reduces a person to their condition.
Each community runs its own instance. Scale by copying the pattern, not by pooling everyone's data into one place.
Why
A national database is a national target. Mutual aid scales by spawning local groups, not by building a honeypot.
Verify
No single store holds every community's people.
Publish your data model, your retention windows, and your privacy posture.
Why
A claim you can't show is a claim you can't keep.
Verify
Anyone can read what you collect and why, without asking you.
Guardian holds itself to all nine. See where we prove it:
This is version 1.0 — a standard improves in the open.