Security & isolation
Your organisation. Your files. Never mixed.
Isolation is not a policy appendix. It is how the product is built. Each organisation is a tenant. People, consent, money and files never leak. Roles are inside the tenant. Residual capacity stays with you at exit.
IMP drafts. Humans Accept. Nothing client-facing becomes truth without a human gate where it matters.
Tenant isolation
Organisation A never sees Organisation B. Country and partner partitions can be designed in so Country A need not see Country B.
Roles
Admin, Staff, Viewer — invited by email, inside your organisation. Viewer is the donor-oversight seat, not a shared staff login.
Consent by purpose
Programme, Research, Funder, Partner — grant and revoke, dated. A checkbox is not an operational control.
Accept trails
Ubu drafts. Humans Accept. Who drafted and who signed is on the record. Draft versus final is visible.
Data ownership
The organisation owns the files. A new implementer onboards onto your historical layer. No consultant lock-in.
Hosting is a design question
Shared cloud, regional (Africa / South-East Asia), or sovereign-isolated. The last is an engagement option, priced on the invoice — not a silent default.
Hosting · a design question
Finance reads this before claims land.
IMP never auto-pays. Your ledger stays your ledger. Files never mix across organisations. Hosting is named here so it is not a footnote after the invoice.
Shared multi-tenant cloud
Isolated tenant on shared infrastructure. Typical for a single NGO or programme team. Organisation is the controller. IMP is the processor.
Regional — Africa
Residency-aware configuration for African operations. Named in Guardrails so finance and the evaluation committee can see it before an invoice lands.
Regional — South-East Asia
Same pattern for SE Asia operations. Not a silent default — you name it on the invoice request.
Sovereign / high-isolation
Elevated isolation, pen-test path, compliance handback. An engagement option, priced in scope — never the silent default.
What this is not
- Not a national ID registry or civil-registration system.
- Not an offline household census or national HMIS.
- Not a cross-organisation data marketplace.
- Not a promise that sovereign-isolated hosting is the silent default — it is a scoped engagement option.
- Not a zero-human evaluation engine. Accept is the control.
- Not the general ledger. Claims map to the programme. Payment stays where it already lives.
Isolation is a design question, not a slide.
Countries, partner organisations and hosting (shared, regional, sovereign-isolated) are first-class inputs. The quote follows the isolation you actually need.
Already have the note? Tell us about this cycle — we price from that.