Run your barangay like it’s 2026, not 1996.

The barangay. Always. We store and process your data as your contracted data processor under the NPC framework — you stay the data controller. On cancellation, you get a full encrypted export (CSV + PDF + audit log) within 14 days, and we destroy our copies within 30 days. We never train models on, sell, or sub-license barangay records.

PII is isolated per-barangay tenant at the database layer. The municipal Command Center portal can only read aggregate, anonymized counts — never individual names, mobile numbers, addresses, IDs, or vulnerability flags. Aggregate queries are enforced by the API layer, not by client-side hiding, so it’s impossible to drill through.

You enter a 30-day Grace Period (full write access, banner warning) → then 60 days of Read-Only (you can still print, export, and view but not create or edit). Only after that does the tenant move to Suspended. Even then, your data is preserved for 12 months in case of late renewal. You never lose records to a payment delay.

No — and we don’t recommend it. We run alongside paper for the first 60 days, with daily end-of-day reconciliation prints. Once your staff is confident, the paper logs become an audit backup. Most barangays transition fully by Day 90.

The citizen portal is mobile-first and caches the last view so residents can still see their submitted requests even on weak signal. The staff portal degrades to read-only when offline so encoders don’t double-write. For total blackouts we recommend printing the daily vulnerable-residents roster as a backup.