We publish what we can substantiate and redact the rest. Client data, donor identifiers, and financial figures never appear on this site. What you can read here is how the systems were designed, released, and handed over.
A case file is released only after the facts in it are signed off. The rest stay sealed — we would rather show you one complete engagement than six confident summaries.
A community giving platform rebuilt end to end — payments, CRM, website, and reporting reconciled into one governed system.
→ Read the case fileCase file in preparation. Contents withheld pending fact sign-off.
IN DECLASSIFICATIONCase file in preparation. Contents withheld pending fact sign-off.
IN DECLASSIFICATIONCase file in preparation. Contents withheld pending fact sign-off.
IN DECLASSIFICATIONCase file in preparation. Contents withheld pending fact sign-off.
IN DECLASSIFICATIONCase file in preparation. Contents withheld pending fact sign-off.
IN DECLASSIFICATIONEvery file above started as a loose description of something the business could not do. Six questions is all it takes to open the next one.
→ Build your briefWANT ONE OF THE SEALED FILES WALKED THROUGH LIVE? WE DO THAT ON A CALL, UNDER NDA WHERE THE CLIENT REQUIRES IT.
Donations in Stripe, operations in spreadsheets, a half-adopted Salesforce org, and a live website nobody could safely change. The core problem was not any single system — it was the absence of a reconciled source of truth and a safe way to make changes.
Real money. Live traffic. Zero cowboy deploys.
Nothing was designed until every system of record agreed with every other one. Payments, CRM records, the accounting ledger, and card controls were reconciled first — read-only, with donor identifiers pseudonymized throughout. Reconciliation is not a prerequisite we bill around; it is the only way to know what the system actually does today.
The public site could not be changed safely because no one could say with certainty what was running. We re-established a pinned, verified source-control baseline so changes became possible again — and reversible. Campaign publication moved from a hope to a procedure.
The Salesforce org was rebuilt around how the organization actually works: a daily review path, custom tabs that follow the review flow, and no raw object lists in front of non-technical staff. We solved the operating problem, not the field layout.
Duplicate donation records were prevented structurally, not by cleanup jobs. Every integration write carries a stable external key, so a retried or replayed sync updates the existing record instead of creating a second one. A duplicate financial record can never be produced by a retry.
Every change moved through the same explicit sequence, and each step was separately approved. Nothing touched production donor data until the step before it was signed off.
See the full method →Salesforce became the operational review layer. QuickBooks remained the accounting source of truth and PEX remained the source of truth for card controls. Spend staged as Draft / Needs Review so operational triage happened before any accounting decision. The boundary is written into the interface, not into a policy document nobody reads.
Least-privilege integration identities. Field-level allowlists on what each sync could read or write. Per-function secrets. A full audit ledger recording every sync request. Donor identifiers pseudonymized throughout the reconciliation work, which was strictly read-only.
INTERFACE RECREATIONS FROM THE DELIVERED WORKSPACE — ALL DATA REDACTED BY DESIGN
Campaign publication, fund tracking, and reporting now run as one governed system, with documentation the organization's own non-technical staff use daily. The engagement ended the way we want every engagement to end: the client's team operating the system without us.
Different systems, same discipline. Tell us what the business can't do today.