Privacy, anonymity and financial exports
Public anonymity, private financial notes and beneficiary alias privacy address different questions. Choose the right donor policy and keep confidential information in its owning workflow.
Privacy matrix
| Information | Current treatment |
|---|---|
| Known donor requesting public anonymity | Party reference remains internally recorded |
| Unidentified donor | No Party and no public-anonymity request flag |
| Ordinary internal donor reference | Visible under normal authorised donation access |
| Donation notes, private evidence, reasons and correction references | Additional charity.donation.sensitive.view required for response projection |
| Shared journal descriptions | Neutral financial text; no donor, bank reference or private reason |
| Beneficiary sponsorship profile | Alias-level projection; no real name, birth date, origin or health record |
| Photo storage reference | Reference only; no upload/download workflow here |
Financial CSV: supported API boundary
The current browser Charity pages do not offer a financial CSV download button. An authorised support integration can use the existing read endpoint below; use the application's normal authentication mechanism without placing credentials in documentation or URLs.
GET /api/v1/charity/finance/export?page=0&size=100
Accept: text/csv
It requires finance export, finance view and donation view, the finance capability and readable-unit scope. Page is zero-based; size is 1–100. It exports posted/reversed donations in ID order for authorised units. It is paginated, not an implied full-tenant export in one response.
The current actual CSV columns are:
donationId,paymentId,postingDate,currency,amount,status
"501","801","2026-11-06","GBP","250.0000","POSTED"
Illustrative IDs are invented. No donor identity, notes, private reasons, evidence or correction references are added, even when the requester has sensitive view. Do not assume the broader architecture allowlist means every allowed field is present in today's CSV. Permissions and scope are rechecked for the request; spreadsheet formula prefixes are escaped.
Safe documentation and support evidence
Use invented data for examples and approved demo data for screenshots. Report tenant, screen, record ID, operation and exact non-secret error. Do not paste credentials, private receipt evidence or actual beneficiary identities into shared tickets. Sensitive-view authority is not permission to circulate private data broadly.
The browser blocks draft editing without sensitive-view rights to preserve redacted notes. Do not interpret a hidden note as an empty note to overwrite. Sponsor update free text needs human review; an alias-only profile cannot automatically remove identities typed by an author.