Ulgama

How Ulgama works, and who holds what

Four places, from your people outward. Every statement here is true of the system as it runs on October 19, 2026.

The same picture on three letter pages, to print for your board
  1. 1 · Your organizationthe people
    • Only your administrators make members; nobody can make an account for themselves. Roles decide what each member can open and do.
    • Signing in needs a password and a second step: a passkey, or an authenticator app. Wide roles must use a passkey. No codes by text or email, ever.
    • A session ends after 30 minutes idle, 12 hours at most. When someone leaves, every browser and phone they used is signed out at once.
  2. Face ID or PIN · sign-in kept in the iPhone's Keychain
    2 · The iPhone appin a member's pocket
    • A scanned document is encrypted on the phone, uploaded, then removed from the phone.
    • The app wipes what it holds on sign-out, after five wrong PINs, after seven days locked, or when signed out from the website.
    • Approvals on the phone are confirmed with Face ID.
  3. All traffic encrypted · roles checked on every request
    3 · Ulgama itselfthe software running for you
    • Every organization's records sit in one database, and the database itself keeps each organization apart, even if the software made a mistake.
    • Names, contact details and tax numbers are encrypted, each organization under its own key. Documents are encrypted where they are stored.
    • Every action goes into a log that cannot be changed or erased, including every look at a name or a donor; its end is signed once a day. A filed document is never deleted.
  4. Hardware security key · Google's own tunnel, never the open internet
    4 · Where it runs, and Charwa LLCwho runs it
    • Servers, database, document storage, keys and backups are in Google Cloud, United States (South Carolina).
    • Backups are encrypted with a key never on a Google machine, kept 400 days locked against deletion, then deleted.
    • Charwa LLC runs and updates the servers, keeps the backups, answers support and decides which paid features a plan includes. Only the owner, plus one sealed emergency account, can reach the servers.
The honest line

Charwa LLC runs the servers, so the people who run them could, technically, reach the records the system decrypts to show your members, such as names and documents. What stands in the way: Charwa LLC has no account in your organization and does not sign in to it; only the owner can reach the servers, with a hardware security key, through Google's tunnel; and the one thing Charwa LLC cannot open at all is the link between a gift and the person who gave it.

What Charwa LLC cannot see, by design

  • Who gave a gift. Encrypted in your officers' browsers with a key Charwa LLC never receives: three printed share codes, any two open it.
  • Passwords. Stored only in a form that cannot be read back.
  • Passkeys. Their secret part never leaves the member's device.
  • Who came to an event. Attendance is counted, not named.

Who else handles data, and exactly what crosses

  • Google Cloud · servers, database, documents, keys, backups · United States
  • Google Workspace · the system's email; no member names, no document contents
  • Apple · notifications: an identifier and a count, never a name
  • Cloudflare · answers the address lookup only; carries no traffic
  • Public registers · only if switched on: the organization's own public details

Nobody else receives data unless the organization sends it itself or the law requires it.

What Ulgama never does. No advertising, no tracking across sites or apps, no analytics service, no selling or sharing of data for marketing, no cookies from other companies. No organization's data is sent to an artificial-intelligence service.

Your records are yours. The organization can export its records at any time. Records are kept for as long as the organization keeps them.