Four department systems that finally agree on who someone is.

Context

A large organization ran its departments on spreadsheets, WordPress, and third-party SaaS with no shared identity. One human showed up as a different record in every system, so nobody could agree on the official count of anything: supporters, members, or leaders. The hard problem was structural. Identity resolution, dedup, and provenance had never been treated as first-class.

What we built

We built four coordinated department systems, all resolving to one identity spine: a central supporter CRM with donations, an HR and onboarding system, a field-operations leadership tracker, and a candidate-pledge program. A canonical golden-record model with an ordered dedup cascade (email → phone → name) and merge-not-delete history sits under everything; a documented, echo-proofed round-trip sync with the membership platform uses a field-ownership matrix so each system owns only what it should. On top of that spine we shipped written data doctrines the whole portfolio obeys: a temporal model with four explicit time dimensions to stop backfill bugs, a permanence rule (never delete a person or a pledge), and a field-provenance contract. Every app shares the same auth, region-scoped access control, and audit trail; the field system even derives a live “who holds a seat but isn’t a paying member” view automatically.

The value

• Departments that used to argue over who someone was now resolve to one golden record. Reconciliation that was manual weekly work is now a live view.
• Merge-not-delete history means no record is ever silently lost, and every edit is auditable with full provenance.
• Governance questions the org couldn’t previously answer, like who holds a leadership seat but isn’t a paying member, are now standing queries, surfaced automatically.
• A 250,000-user source system syncs continuously without the loops and overwrites that wreck point-to-point integrations.