Domestic-violence organizations need employees to find information quickly.
Staff may need immediate access to shelter procedures, hotline guidance, volunteer instructions, safety protocols, community resources and administrative policies.
At the same time, these organizations hold information that could create serious safety and privacy risks if exposed to the wrong person.
The challenge is not simply organizing documents.
It is separating general operational knowledge from restricted information while still helping employees do their jobs.
Example: A Regional Domestic-Violence Organization
Consider a nonprofit operating:
- An emergency shelter
- A crisis hotline
- Transitional housing
- Legal advocacy
- Counseling referrals
- Community education
- Volunteer programs
- Youth and family services
- Financial-assistance programs
Its employees may need to know:
- How to complete a shelter intake
- What to do during a security incident
- Which community resources are available
- How volunteers should respond to disclosures
- Who approves emergency purchases
- What documentation a grant requires
- How to request technology support
- Which records must be retained
These are legitimate operational questions.
But the organization may also hold restricted information involving survivor identities, shelter locations, safety plans, legal matters, case notes and internal incidents.
Those two types of knowledge should not be treated the same way.
Not All Organizational Information Has the Same Risk
A volunteer handbook and a survivor safety plan are both organizational information.
They do not require the same access controls.
General operational knowledge may include:
- Employee onboarding
- Volunteer expectations
- Expense procedures
- Approved community resources
- General shelter operations
- Training schedules
- Facilities procedures
- Public program descriptions
- Technology instructions
Restricted information may include:
- Personally identifying survivor information
- Individual case notes
- Confidential shelter details
- Safety plans
- Legal records
- Internal investigations
- Personnel records
- Sensitive partner communications
- Security incidents
- Restricted leadership decisions
A secure knowledge system must distinguish between these categories before AI is introduced.
Confidentiality Is a Safety Requirement
For victim-service organizations, confidentiality is not merely an administrative preference.
The National Network to End Domestic Violence’s Safety Net Project explains that technology decisions must account for survivor safety, privacy and applicable confidentiality obligations.
The organization must consider what information is collected, where it is stored, who can access it and whether it should be available through an AI assistant at all.
A system that makes information easier to find is only useful when it preserves those protections.
The Current Folder Structure May Not Be Enough
Many nonprofits already use SharePoint folders, Teams channels or shared drives to limit access.
But permissions may have grown informally over time.
Common problems include:
- Entire departments receiving access by default
- Former employees remaining in security groups
- Sensitive files stored in general folders
- Documents copied into less secure locations
- Links shared without understanding the permissions
- Confidential information attached to broad email chains
- Multiple versions stored under different access rules
- Volunteers receiving more access than their roles require
The organization may believe the content is restricted because it lives in a named folder.
The actual permission structure may tell a different story.
Build Separate Knowledge Areas
A domestic-violence organization should not place all information into one broad repository.
A practical structure may include several controlled areas.
General Staff Knowledge
This may include:
- Employee onboarding
- General program procedures
- Facilities information
- Technology guidance
- Expense and purchasing procedures
- Public community resources
- Organization-wide training
- General emergency contacts
Program-Specific Knowledge
This may include:
- Hotline procedures
- Shelter operations
- Transitional-housing guidance
- Legal-advocacy procedures
- Volunteer instructions
- Youth-program materials
Access can be limited to staff assigned to those programs.
Restricted Operational Knowledge
This may include:
- Security procedures
- Confidential shelter details
- Escalation protocols
- Serious-incident guidance
- Restricted partner contacts
- Internal risk assessments
Highly Restricted Records
This may include:
- Survivor case records
- Legal information
- Personnel files
- Internal investigations
- Safety plans
- Personally identifying information
Some of this content may need to remain entirely inside the case-management, legal or HR system rather than being included in the knowledge hub.
Employees Should Only Receive Answers They Are Authorized to See
A permission-aware AI assistant should not search the entire organization and then decide what to reveal.
It should operate within the user’s existing access rights.
For example:
- A volunteer may ask how to respond when someone discloses abuse.
- A shelter advocate may access approved shelter procedures.
- A legal advocate may access legal-program guidance.
- A supervisor may access restricted escalation procedures.
- HR may access personnel policies and records.
- Leadership may access governance and risk information.
Each person should receive answers only from approved sources they already have permission to view.
This is a core part of the secure nonprofit knowledge hub approach used by Pixeldust.
Do Not Mix Procedures With Survivor Records
Employees may need to know how to perform a case-related process.
That does not mean the procedure and the survivor’s record should live in the same knowledge source.
For example, an advocate may need access to instructions explaining:
- How to document a service
- When written consent is required
- How to respond to a records request
- Who can approve information sharing
- What to do after an accidental disclosure
Those instructions can be available through the knowledge hub.
The survivor’s actual record should remain protected inside the designated case-management system.
This separation helps staff understand what to do without broadly exposing the underlying case information.
Information Sharing Requires More Than Internal Approval
Domestic-violence organizations often coordinate with law enforcement, courts, healthcare providers, housing organizations and other service agencies.
That cooperation does not automatically permit survivor information to be shared.
The Safety Net Project’s guidance on releases and confidentiality emphasizes that personally identifying information generally cannot be shared with outside partners merely because they participate in a coordinated team. Survivor consent and applicable legal requirements still matter.
A knowledge hub can help staff find the approved information-sharing procedure.
It should not make the decision to release information.
AI Should Provide Guidance, Not Make Disclosure Decisions
An AI assistant may help an employee find:
- The confidentiality policy
- The approved release form
- The escalation contact
- The records-request procedure
- The required approval steps
- The applicable training material
It should not independently determine:
- Whether consent is valid
- Whether information may legally be disclosed
- Whether an emergency exception applies
- Whether a subpoena must be followed
- Whether sharing information creates a safety risk
Those decisions require authorized staff, legal guidance or leadership review.
Start With Information That Does Not Contain Survivor Data
The safest first phase is usually a knowledge area that provides operational value without exposing case information.
Possible starting areas include:
- Staff onboarding
- Volunteer training
- General HR guidance
- Expense and purchasing procedures
- Technology support
- Public community resources
- Facilities procedures
- Grant administration
- General program manuals
This allows the organization to establish content ownership, permissions and governance before considering more sensitive knowledge areas.
Review the Content Before Connecting AI
The organization should identify:
- Which documents are authoritative
- Which documents contain confidential information
- Which content should never be indexed
- Which information belongs in another system
- Who owns each knowledge area
- Which employees should have access
- When the material was last reviewed
- Which outdated copies should be archived
The Office on Violence Against Women identifies policies or procedures that compromise the confidentiality and privacy of people receiving funded services as unacceptable activities.
That makes content review and permission planning part of service safety—not simply technical housekeeping.
Use a Simple Classification System
Every document can be assigned a classification such as:
- Public
- Internal
- Program-restricted
- Confidential
- Highly restricted
The classification should help determine:
- Where the document is stored
- Who can access it
- Whether AI can use it
- Whether it can be shared
- How long it is retained
- Who approves changes
- How often permissions are reviewed
The system does not need to be complicated.
It needs to be clear and consistently applied.
Permissions Should Follow Roles
Access should be based on job responsibilities rather than individual convenience.
A domestic-violence organization may define roles such as:
- Volunteer
- General employee
- Shelter advocate
- Hotline advocate
- Legal advocate
- Program supervisor
- HR
- Finance
- Executive leadership
- Board member
Each role receives access to the knowledge required for its work.
Temporary access should have a defined purpose and expiration date.
When an employee changes roles or leaves, access should be reviewed promptly.
Database Connections Need Separate Evaluation
The nonprofit may use systems for:
- Case management
- Hotline records
- Housing programs
- Donor management
- Volunteer management
- HR
- Finance
- Grant reporting
Selected information may sometimes be accessed through approved connectors, APIs, indexed copies or scheduled exports.
But a database connection should never be treated as automatic.
The organization must determine:
- Which fields are actually needed
- Whether personally identifying information is involved
- Which users may access the data
- Whether read-only access is sufficient
- How the activity will be logged
- Whether the vendor permits the integration
- What licensing is required
- Whether the connection creates new disclosure risks
For many survivor-related systems, the safest decision may be not to connect them.
Auditability Matters
The organization should be able to determine:
- Who accessed a restricted knowledge area
- Who changed a document
- Which version was used
- When permissions changed
- Who approved the content
- When the material was last reviewed
Audit records help leadership investigate problems and demonstrate that information is being managed intentionally.
They do not replace good security practices, but they provide accountability.
Test the System Using Different Roles
Before launch, the organization should test the knowledge hub as several types of users.
Testing should confirm:
- Volunteers cannot access employee-only guidance
- General employees cannot reach restricted shelter information
- Program staff only see materials for their roles
- Confidential content does not appear in broad search results
- Archived documents do not generate current answers
- Restricted links cannot be opened by unauthorized users
- Answers clearly identify their approved sources
Testing only as an administrator can hide permission problems.
Better Access and Better Security Can Coexist
Security is sometimes treated as the opposite of accessibility.
That does not have to be true.
Employees should be able to find the information they need without gaining access to information they do not need.
A well-designed knowledge hub can help a domestic-violence organization:
- Reduce repeated staff questions
- Improve onboarding
- Standardize procedures
- Protect confidential information
- Preserve institutional knowledge
- Clarify information-sharing rules
- Reduce reliance on individual employees
- Maintain separation between general guidance and survivor records
Pixeldust helps domestic-violence organizations and other human-service nonprofits organize operational knowledge, define permission boundaries and build secure Microsoft-based knowledge hubs.
The goal is not to place every piece of organizational information into AI.
The goal is to make the right knowledge available to the right person without weakening the protections survivors depend on.
