Billing state, plan tier, office hours and connectivity change everything else. They never reach a student’s help button, the escalation chain, safeguarding logging, or anyone’s right to export their own data. That is not a policy we wrote down — it is a trigger in the database that refuses.
Students and host families get one persistent button labelled “Get help”. Underneath it: write it however you like — text, voice or a photo. Below that, a red-bordered escape that skips everything: “I’m in danger.”
One press writes a real row, notifies every active admin and staff member of the organisation, and files an audit entry — in a single database statement, so there is no half-sent state. Then the sheet reads the row back and shows it, because “I asked for help” should not be a leap of faith.
Students never see a ticket number. Every answer carries a visible “this didn’t help — get a person.”
“A student must never be able to tell, from her own screen, that her organisation is behind on an invoice.”
The sentence the entire billing ladder is designed around.
Ariadne answers from the person’s own record and the programme handbook. No ticket is created.
She prepares the change and one tap confirms it.
A named owner, never a department. The full context travels with it, so nobody is asked to repeat themselves.
The on-call chain. Never a queue.
Safety skips straight to rung 4. Anything touching safety or medicine is a sixty-second target whatever an organisation has configured — that one is not adjustable, on purpose.
These are deterministic and bilingual — plain pattern matching over what the person wrote, no model consulted, each printing its own evidence sentence so a member of staff can see why it fired.
Routing is deterministic rules first and AI only for classification, and staff can override any rule — except the two that are pinned.
Staff never see a raw ticket list. Each item arrives pre-read and with a drafted resolution — the job is to judge, not to dig. And “an agent” appears nowhere in this system: a handover names the human. Marta joined, never an agent joined.
“Somebody picked up.”
The only measure of an escalation chain that matters.
Knows the family and the town. First call, every time.
Can move a student the same night and speak to the parents.
Can involve authorities, insurers and lawyers.
Called by a person, never by the system.
It widens deliberately rather than paging everybody at once: going wider before the narrow rung has had its minutes is how an organisation teaches its own people to ignore pages.
An organisation with nobody on the rota is told so in a red banner before it relies on the chain — and if a page reaches zero people, that fact is surfaced rather than swallowed.
Closed only when a second person agrees she is safe.
Harm or abuse · medical emergency · missing student · police contact · placement breakdown. Closing one of these asks for the name of the second person who agrees the student is safe, and what was established — where they are, who spoke to them, what happens next.
It also files a safeguarding incident on the student’s record. That record cannot be deleted from there, and your name is on it. A resolution shorter than a dozen characters is refused: a record closed with an empty resolution answers nothing a year later.
Abuse, and anything marked critical, escalate in the database — no setting on any screen can turn that off.
Twenty-eight product commitments, tracked from planned to shipped.
This is the safety contract for the product, not a claim that every row is live today. The catalogue includes shipped, in-progress and planned work; the capability registry is the source of truth for what is currently shipped. Do not rely operationally on a row that is not listed as live or guaranteed in your contract.
The list is world-readable — anybody can audit what an organisation is entitled to — and insert, update and delete are revoked from every application role. Publicly auditable, privately immutable. Maturity varies: some are finished features, some are in progress. What is uniform is the entitlement: no plan, no organisation, no operator can take one away.
Every entry carries the actor, the action, the entity, the IP, the device and the timestamp. Sensitive reads are logged, not only writes — and so are denials.
Update and delete are blocked by a database trigger, not by a role. Table-owner privilege does not get around a BEFORE trigger.
Exactly one read policy exists. Platform-level rows are readable by nobody through it.
“Guarded grants, denials and designated sensitive views leave audit receipts.”
What a guardian is promised, and what the log is for.
The most safety-critical dialog in the product — the help sheet — is the one that proves it: focus trapped and returned, Escape closes, and Escape keeps the draft. Only Cancel clears it.
“Audit coverage is stated precisely; it is never described as universal when it is not.”
The safety floor is in every plan, and every current plan includes the same 30-day organisation trial.
