Housing data is sensitive and multi-party by nature. Annum is designed so that a CBO, a city and an employer can work from one record without any of them seeing more than the member agreed to.
Every tenant-owned table carries the organization it belongs to and a row-level security policy that checks the signed-in user's membership. Cross-tenant reads return nothing — not an error page that confirms a record exists.
Six roles — Annum operator, CBO administrator, case manager, municipal analyst, employer administrator and read-only auditor — are stored separately from profiles and evaluated server-side for every write.
A member grants a sponsor a named scope (identity, household, income, employment, housing history, health & accessibility). Sponsors see aggregates computed only from consented records, with counts under five withheld. Revocation takes effect on the next refresh.
Retrying a sync, requeuing a payment, approving a Dorothy run, changing an application state or resetting the demo all require a typed confirmation and a written reason. The action runs server-side after a fresh permission check.
Every guarded action appends an audit event with actor, before/after state, reason, correlation ID and source timestamp. Audit rows cannot be edited or deleted by any application role; the database rejects the attempt.
HMIS, property feeds and payment rails are reached through adapter interfaces that run only on the backend. The browser never holds a vendor credential. Freshness SLAs, failed syncs and stale sources are surfaced with their correlation IDs.
Dorothy scores eligibility against versioned rule sets and explains each criterion in plain language. Its proposals are invisible to members and sponsors until a counselor approves them, and every run is reviewable.
Service credentials live in backend configuration only. Public web pages use publishable keys against insert-only or read-only policies, never privileged access.
| Data | Case manager (CBO) | Municipal analyst | Employer administrator | Annum operator / auditor |
|---|---|---|---|---|
| Member identity & contact | Full | Pseudonym only | Not visible | Full (operator), read-only (auditor) |
| Household, income, housing need | Full, editable | Aggregates from consented records | Aggregates from consented records | Full, read-only |
| Documents & evidence | Verify / reject | Not visible | Not visible | Read-only |
| Dorothy proposals | Review & approve | Not visible | Not visible | Review (operator), read-only (auditor) |
| Programs, units, rule versions | View | View own; funded programs | Manage own benefits | Manage all |
| Integration health & payments | Not visible | Not visible | Not visible | Operate (operator), read-only (auditor) |
| Audit log | Own organization | Not visible | Not visible | All tenants |
Formal certifications and a completed security questionnaire are shared during pilot scoping. Ask us for the current control matrix.