System Architecture v3.2

Last updated: July 22, 2026

System Boundaries

AI4Love does not operate its own data center infrastructure. All hosting, storage, and credential management is delegated to SOC 2 Type II certified providers. The system is stateless — serverless functions process requests and release memory when complete.

What AI4Love Operates

Application logic (serverless functions on Vercel)
7 core analysis agents (scheduled via Make.com), plus Queue Cleanup and two resurrection workflows that support the agent pipeline on their own schedule — these are maintenance jobs, not additional analysis agents
Nightly publisher — a write-only sync job that runs after the analysis agents complete, syncing people, activity, and insight records to each organization's own mirror file
MCP server for AI assistant access — 40 read-behavior tools and 2 narrowly gated write tools for authenticated clients
Dashboard UI (static SPA on Vercel)

What AI4Love Does Not Operate

Databases or data warehouses
Email or messaging infrastructure
Credential storage systems (delegated to Nango and Doppler)
AI model training or hosting

Data Flow

Source Systems                    Processing                      Output
─────────────                    ──────────                      ──────

┌──────────────┐
│ Blackbaud    │──READ──┐
│ RE NXT       │        │
└──────────────┘        │
                        ▼
┌──────────────┐    ┌──────────┐    ┌─────────────┐    ┌────────────┐
│ Mailchimp    │──READ──▶│ Airtable │◀───│ Make.com    │───▶│ Airtable   │
│              │    │ (People,  │    │ (7 Agents)  │    │ (Insights) │
└──────────────┘    │  Donors,  │    │ Nightly run │    └─────┬──────┘
                    │  Events,  │    └─────────────┘          │
┌──────────────┐    │  etc.)    │          ▲                  ▼
│ Environics   │──READ──▶│          │          │           ┌──────────┐
│ Analytics    │    └──────────┘          │           │ Dashboard│
└──────────────┘         │               │           │ (UI)     │
                         │         ┌─────┴─────┐     └──────────┘
                         │         │ Claude API │          │
                         │         │ (text gen  │          ▼
                         │         │  only)     │     ┌──────────┐
                         │         └───────────┘     │ MCP      │
                         │                           │ Server   │
                         └───────────────────────────│ (40 read,│
                                                     │ 2 gated  │
                                                     │  write)  │
                                                     └──────────┘

The two gated MCP write tools are omitted from the boxes above to keep the diagram readable: add_to_kindmind writes curated research to Pinecone (allowlisted curator organizations only), and mark_campaign_refined writes organization-scoped Generated Campaign metadata back to Airtable. Neither writes to People, Donors, Volunteers, Engagements, or any other supporter source table.

Flow Explained

Source systems (Blackbaud, Mailchimp, Environics) are read-only inputs. AI4Love pulls data on manual trigger or scheduled sync. Nothing is written back.
Airtable is the hub. All supporter records, donations, events, engagements, and participation live here. Airtable automations create Participation records from source data and stamp them for agent processing.
Make.com runs 7 core analysis agents nightly. Agents 1-5 use the prefetch proxy pattern: Make.com pulls queued supporters, the backend pre-fetches each supporter's full timeline from Airtable, then sends everything to the Claude API in one call. Agent 6 reads today's insights and sends them to Claude for cross-agent pattern detection, writing results server-side. Agent 7 embeds insights, queries Pinecone for sector research, and writes enrichment guidance. All agents and campaign-generation calls are constrained by the Content Integrity Policy (v2026-04-07), fetched at runtime and prepended to the system prompt, which prohibits fabricating names, programs, outcomes, quotes, or statistics not present in the provided data. Queue Cleanup and the two resurrection workflows run on their own schedule to support this pipeline — they don't generate new insight types themselves.
Verification — After each insight is written, the /api/verify-insight endpoint compares AI-claimed metrics against actual Airtable data. Results are written back to the insight record. Cost per run is logged to the Engine Logs table.
Dashboard reads from Airtable to display insights, metrics, and recommendations to staff. Campaign generation also calls Claude with the Content Integrity Policy enforced. Staff take action — the system does not.
MCP Server provides supporter-data access to AI assistants (Claude, ChatGPT, and other MCP-compatible clients). 40 of the 42 authenticated tools are read-behavior only. The remaining 2 are narrowly gated writes — add_to_kindmind (curated research → Pinecone, allowlisted curator orgs only) and mark_campaign_refined (organization-scoped Generated Campaign metadata → Airtable). Neither writes, modifies, or deletes People, Donors, Volunteers, Engagements, or any other supporter source record. Archived insights are filtered from query results. Unauthenticated clients see 3 diagnostic tools only (health, auth status, identity) — no supporter data.
Publisher — After each nightly agent run completes, a write-only publisher job syncs people, activity, and insight records — records only, no formulas or automations — to a file your organization owns in its own workspace (Google Sheets for most clients). Your organization can revoke this write access at any time; the file itself, and everything already written to it, is unaffected by that revocation and survives cancellation permanently.

Connection Model

Platform	Auth Method	Direction	What Flows
Blackbaud RE NXT	OAuth 2.0 (refresh token)	Read only	Constituents, gifts, actions, events
Mailchimp	API Key	Read only	Members, campaigns, activity
Environics	OAuth 2.0 (client credentials)	Read only	Postal-code-level PRIZM segments
Airtable (working base)	Scoped Personal Access Token or provisioned service credential, per organization, held in AI4Love's own account	Read + Write	Required bases and tables only; writes restricted to insight, enrichment, and campaign-workflow fields by application logic
Organization mirror (Google Sheets or comparable)	Service account, editor on one file	Write only	People, activities, insights
Claude API	API Key	Send + Receive	Agent prompts sent, insight text received
Pinecone	API Key	Read + Write	Research embeddings (KindMind) and organization knowledge (Vault); writes limited to the `add_to_kindmind` MCP tool for allowlisted curator orgs

Infrastructure Providers

Provider	Role	Compliance
Airtable	Data storage (supporter records, insights)	SOC 2 Type II
Vercel	Application hosting and compute	SOC 2 Type II
Make.com	Agent orchestration (nightly runs)	SOC 2 Type II
Nango	OAuth credential management	SOC 2 Type II
Doppler	Secrets management	SOC 2 Type II
Anthropic	LLM provider (Claude API)	SOC 2 Type II
OpenAI	LLM provider (ChatGPT API, MCP path)	SOC 2 Type II
Pinecone	Vector search (research + org knowledge)	SOC 2 Type II

Each sub-processor operates under their own independently audited security standards. AI4Love monitors provider status pages and security advisories. Changes to sub-processor agreements or compliance status are communicated to affected organizations.

System Architecture v3.2 ​

System Boundaries ​

What AI4Love Operates ​

What AI4Love Does Not Operate ​

Data Flow ​

Flow Explained ​

Connection Model ​

Infrastructure Providers ​