The person doing the work
One more task is not a security strategy.
A program leader may also be the fundraiser, scheduler, case coordinator, and person fixing the printer. That work may be underpaid, unpaid, or interrupted by something more urgent.
A control that only works with a dedicated security team is a poor fit. Our tools should make a specific decision easier, show their limits, and leave you with something usable.
The goal is to reduce avoidable exposure without making you responsible for solving the hostility your community lives with.
Threats, consequences, responsibility
Who pays when a control fails?
These are scenarios to plan around, not claims about incidents at your organization. The person bearing the cost may never have chosen the tool.
A client note pasted into an AI tool
Names, contact details, or contextual clues can identify someone outside your organization.
Who bears the cost
The person described may face unwanted disclosure, harassment, or loss of trust in a service they need.
What this tool can change
A text scan can flag some patterns. It cannot find every identifying detail or approve sharing.
A shared account after a volunteer leaves
A working login can expose messages, records, and internal plans.
Who bears the cost
Clients and staff bear the exposure; the program leader inherits recovery work and interrupted services.
What this tool can change
Our scanner does not secure accounts. Access review, multi-factor authentication, and recovery planning remain separate work.
An instruction hidden in a document
An AI tool may follow text from an untrusted source instead of the task you gave it.
Who bears the cost
A misleading draft or disclosed information can harm the person relying on your program.
What this tool can change
Pattern checks catch some known forms. Review the source and output; a clean scan is not proof of safety.
A technical control cannot resolve political hostility, coercion, or chronic underfunding. It can reduce a particular exposure and make the next decision clearer.
A person you can hold accountable
I work across security research, engineering, and design. I’m building Secure Pride for the people keeping LGBTQ+ organizations running, and the people who rely on them.
I want the work to be inspectable: what a tool does, where it sends information, what it misses, and who is responsible for it. You should not have to trust a protection badge to understand those things.