Trust & data ownership
Trust & data ownership
The nonprofit owns its data and controls who accesses it. Funders pay to sponsor nonprofits, never for access to nonprofit data. Nothing is shared without consent. Resilia is built on Impact Lattice, a technology infrastructure for entrusted data — these commitments come from how it works, not from promises layered on top.
01 · Who has the say
Nothing happens to your data without your say.
We don't own your data. We never did. Every record you enter answers to you alone: you consent to access, you revoke it, you export everything, you delete. The say is built into the platform's data model, not conferred by our terms.
Nobody else's money changes that. A funder paying for your seat gets an invoice, not access — the check buys access, never the data. What a payer does see is the receipt: whether the seats it bought were activated. Anything more is yours to consent to. The same holds for every node: nonprofits, grantmakers, and consultants each have the say over what they put in.
One asterisk, because trust pages should be honest: the exceptions are the ones the law forces on everyone — a valid court order, the mechanics of backups. When they happen, we tell you, and we produce the narrowest thing the order requires.
02 · What we never do
Five commitments, built in.
These five are the canonical commitments. The Privacy Policy and the Terms restate them in legal form, and they can never be weakened without your affirmative consent (Terms §15).
We can't sell your data.
We don't own it, so the right to sell it isn't ours — it's yours. A buyer of Impact Lattice would buy software, not data. The most we can do is build features that let you sell your own data, on your own terms.
We can't license your data.
We hold no rights to give. The most we can do is build features that let you license your own data, on your own terms.
We can't train AI on your data. Only you can direct that.
No AI model learns from your data unless you direct it — a model built for you alone, or a sector model you choose to join alongside your peers.
We can't show your data to anyone you haven't consented to.
Not to another nonprofit, funder, or consultant. Not in dashboards, benchmarks, or aggregates the math could trace to you. The view engine refuses to render non-consented data. The one exception is the baseline running the software takes — our staff and vendors processing it to operate your account. That's plumbing, not an audience.
We can't write the meaning of your work.
Nothing publishes under your name in the platform's voice without your consent. What a trusted partner builds from views you've consented to share is their own analysis — a fact visible to you. Your story stays yours to tell.
One distinction worth naming: your data stays yours. What the AI generates from it — the outputs — is dedicated to the Impact Lattice Commons.
03 · What you can do
Everything the say entitles you to.
Contribute your data to sector research. Pool it with peers to find what works. Train an AI on your records — for your own operations, or as part of a model that benefits everyone. License your own data to a researcher or partner. Consent to share a view with a consultant for an engagement, a slice with a funder for a board meeting. Revoke any of it, any time.
These are examples, not limits. Each is your call. Each is your work.
04 · How sharing works
Per-relationship, revocable, in plain English.
Every share is a consent grant: named (which view), scoped (which fields and rows), bounded (which period, which purpose), and revocable. Both sides see the consent grant. Audit trails run in both directions, and nobody's access is exempt — there are no overrides that let a funder or consultant see past a consent grant, and when our own staff access an account to run the platform or help you, that lands in your audit trail.
05 · After your data has been used
Some access can't be unwound. We're honest about that.
Revoking a consent grant cuts off access. But a memo a funder already wrote from your data doesn't disappear when you revoke. Here's exactly where the line sits.
What the architecture does
- Personal identifiers never reach a derivative artifact.
- Every consent grant has a purpose and a time bound.
- Every memo or benchmark built from your data carries provenance tags.
- Revoking flags every artifact built from your data in its owner's workspace.
- Your audit trail shows when someone composed something from your data, not just when they looked.
What it can't do
- Reach into another organization.
- Unwrite a filed memo.
- Undo what a reader already knows. Those are limits on any consent architecture, including ours.
The platform's job is to keep even the limits in plain sight. Who knows what about your organization, from which data, under which consent grant — you don't have to trust us on any of it. You can look.
06 · Leaving
You leave with everything.
A nonprofit leaving
Exports all their records, files, and reports — complete, free, nothing withheld.
A funder leaving
Keeps its own analyses and loses the views consented to it. It exports no grantee data, because it never owned any.
A consultant leaving
Keeps what's theirs — methodology, frameworks, templates — and loses access to client workspaces.
One honest note: the ledger is append-only. Your content goes with you, unrecoverable here; what stays is the skeleton — that a claim existed, when, under which consent grants. It's the same trust signal you relied on while you were here, and it's treated like data: only the parties to each consent grant ever see their part, and leaving never widens who sees the trace.
We make leaving easy because that's what gives us a reason to keep being useful.
07 · Nonprofits First
Terms you'd choose, not just accept.
If you're weighing Resilia for your organization — a foundation, a network, a nonprofit — the contract is deliberately more favorable than a typical SaaS vendor agreement. Not as a promise, but as structure: the commitments on this page are what the Terms, Privacy Policy, and Acceptable Use Policy put in legal form, and they can't be weakened without your affirmative consent (Terms §15).
A typical vendor contract
- Takes a broad license to your data — often to train its AI.
- Treats your data as a company asset that transfers if the vendor is sold.
- Locks you out when payment lapses.
- Reserves the right to change the terms unilaterally.
- Makes export on exit limited, billable, or slow.
Resilia
- No ownership of your data, and no training on it unless you direct it.
- Your data is never an asset in a sale — an acquirer inherits every commitment.
- Unpaid means a downgrade to the free tier, never lockout — data and consent grants intact.
- The protected commitments can't be weakened without your affirmative consent.
- Leave with everything, free, for at least 60 days — and we tell you within 72 hours of a confirmed breach.
The point isn't that we promise to be good. It's that the structure doesn't let us be otherwise — and if your organization needs a negotiated agreement or a signed data processing agreement, the same commitments carry into it, unmodified.
Trust you can check beats trust you take on faith. Everything on this page is the structure. Everything else is just policy.