The full list
Filter by area. Everything is labelled shipped or planned, because a features page that lists intentions as capabilities is the same unsupported promise this product exists to catch everywhere else.
Who needs attention today
4 of 128 members · ranked by band, then by direction
Hospitalization logged · no contact in 21 days
Claim past its 17-day due date · never acknowledged
7 people in the household · new dependent added
Two outreach attempts unanswered · renewal in 38 days
55 shipped · 8 on the roadmap · everything below is marked either way, because a features page that lists intentions as capabilities is exactly the kind of unsupported promise this product exists to catch.
Cura, Onus, Familia, and Fides scored separately, because a member can carry several at once. High Onus with low Cura is a billing problem. High Onus and high Cura is a family in crisis, and the difference should be visible at a glance.
A score is the sum of the weights of every rule that matched. No model, no training data, no learned coefficient. The reasons appear beside the number with their exact weights, so a staff member who distrusts a score can check it and either agree or point at the rule they disagree with.
Every rule, its weight, and its rationale are published to administrators. A system that cannot be argued with does not get trusted with pastoral care.
Clear, watch, attend, urgent. The board ranks by band and then by direction, and ties break toward Cura — when scores are equal the hurting person outranks the expensive case. That is a moral choice written into the code, not an accident of sorting.
Dismissing a signal means "I have seen this and handled it", not "never show me this member again". It returns when the facts get materially worse — a higher band, or a 15-point jump. Someone who dismissed "member is quiet" should absolutely be shown "member is quiet and now hospitalized".
Size, dependents, caregiving, and recent change are properties of a household, so they score on the primary contact rather than on every member. Scoring them per-person put eight rows on the board for one family and ranked nothing.
The compass may open itself at most once per calendar day, and only behind a high-confidence action. Software that pops open for routine work gets closed reflexively — and is then closed reflexively on the morning a member is in an ICU.
Dismissals, cooldowns, and orientation progress live in the database rather than in one browser, so what a staff member handled at the office is still handled at home.
Scoring runs from a queue with no request context, against the same pure rules the tests exercise. Given the same facts and the same timestamp the output is byte-identical, forever.
Scoring the household directly, rather than through the primary-contact proxy, so the board can show a family as one row with its members underneath.
Signals are a point-in-time reading today. Retaining them would answer the question a director actually has: is this ministry getting better at follow-up?
Of every dollar members contributed, how many cents reached their medical costs — measured against the ACA medical-loss floor that health care sharing ministries are not held to. Clearing a bar you are not held to says something no marketing page can.
Money in and money out, stitched by union rather than joined — so a month with contributions and no distributions can never be lost to an inner join. That month is the loudest signal this system produces.
Diversion hides in payments to affiliated entities, so the API refuses a related-party disbursement that does not state the relationship.
Each provision declares which denial reason codes it actually authorizes. That field is load-bearing: the signature pattern in this category is marketing "covered from day one" and then denying on precisely that basis.
Four checks, each the week-it-happens version of a deposition exhibit: a denial citing no provision, one citing a provision that does not exist, one citing a provision that does not authorize the stated reason, and one applying a guideline that took effect after the member joined.
Each integrity rule records the documented failure it traces to. When a ministry disputes a finding, the answer should be a specific thing that happened to a real community, not an abstraction.
"One of one denials" is a 100% rate carrying almost no information. Rate-based rules need five observations before a rate is treated as a rate, so a small ministry with a single lapse does not score like a collapse.
A published endpoint showing the share ratio and how it was calculated, with no member data in it. Opt-in, because publishing is a decision a ministry makes rather than one made for it.
A turnaround target puts a due date on each claim at submission. The clock pauses while waiting on the member — but the waiting-on-member status has its own ageing rule, because that status is exactly where claims go to die and excluding it would create an incentive to park them there.
A claim nobody has opened escalates before its deadline, not after. The member cannot tell "being worked" from "lost", and assumes the former until it is too late.
Provider identifiers are validated with the actual check-digit algorithm, not a length test, alongside procedure and diagnosis code formats. Incomplete intake is the quiet reason claims stall weeks later.
Both a reason code and a guideline reference. It warns loudly — but does not block — when the citation does not hold up, because blocking would push staff to pick whatever provision the form accepts, and a recorded warning keeps the honest record instead.
Chargemaster prices bear little relation to cost. Repricing against the Medicare allowable commonly saves a substantial share on facility claims. Every proposal records its basis, so it reads as a negotiation rather than a refusal to pay — and with no reference rate on file it declines to reprice rather than inventing a number.
Checked against the guideline version that actually binds that member and the ministry’s real denial history. Deliberately never promissory — "likely" is the strongest word it may use about a future claim, and every check is written to the audit log.
An appeal is tracked separately with its own due date, so it cannot inherit the silence that produced it.
Submitted, acknowledged, in review, shared — with the date each step happened and the date the next one is due.
Byte-order marks, mixed date formats, embedded newlines, ragged rows, duplicate headers, "Mbr #" as a column name. A hand-written RFC 4180 parser, because messy files need forgiving behaviour that most libraries make hard to reach.
An alias table first, content sniffing as a fallback. Adding an alias for a ministry whose file does not auto-map is a one-line change.
Only a nameless row is an error. Everything else imports with a warning attached, because refusing a family over a typo’d postcode is worse than importing them and flagging it.
Email, then phone plus surname, then name plus date of birth. Fuzzy name matching is deliberately absent: it would catch some real duplicates and silently merge some real siblings, and merging two people who are different people is far worse than importing one duplicate a human later notices.
The preview is persisted, so the commit works from the exact rows that were approved — not from a re-parse that may have drifted. A blank cell means "not provided", never "delete what you know".
Each row is marked committed in the same batch that writes its member, so an interrupted or redelivered import picks up where it stopped.
The original upload is retained, so any question about what was imported can be answered against the file that was actually sent.
Spreadsheet files without a CSV export step. The pipeline downstream of parsing is already format-agnostic, so this is one function at a seam that already exists.
Eligibility, share amounts, and most care conversations happen at the household, not the individual — so the data model treats it that way rather than bolting families together afterwards.
Keyset pagination rather than offsets, so page 400 of a roster costs what page 1 costs.
There is no floating-point currency column and there never should be. A share amount that drifts by a cent is a member ringing to ask why their statement is wrong.
Soft deletes throughout, so a removal is recoverable and the record of what was known stays intact.
Uploads stored against a member or a household, with prefixes that keep one ministry’s files categorically separate from another’s.
The API supports every mutation and the read screens are complete, but the interface currently offers forms only for contact logging and follow-ups. The remaining forms are plain form work against settled contracts.
A care item nobody owns is a care item nobody does. Every request carries a person and a follow-up date, and an overdue one scores.
Recording an outreach is not filing — it is the input that tells the compass this family has been reached, and quiets a signal that would otherwise keep asking.
A short, derived list of what is worth doing now, rather than a dashboard that asks the reader to work out the priority themselves.
Signals are computed and displayed but never pushed. Most missed follow-ups happen because nobody opened the dashboard, which makes delivery the highest-value thing not yet built.
The reason ministries stay on a platform they have outgrown is that switching appears to mean asking every household to set up payment again. It does not. Stored cards and verified bank mandates transfer from your current processor to Stripe directly, with no action from members and no gap in billing.
Auxilium writes the data-portability request for your specific processor, in the language that gets it understood rather than bounced. Ministry staff should not have to learn the phrase "PAN export" to leave a vendor.
Payment data moves from your old processor to Stripe directly and never passes through Auxilium. The manifest uploaded here carries the last four digits and nothing more, and any file containing a full card number is refused before it is stored.
A malformed export costs a full round trip to discover. Validation runs up front and names the specific rows that will not migrate, so the problems are fixed before anyone is waiting on them.
Returned records match to your roster on your own member number first, then email. There is no fuzzy matching, because an unmatched row is a short list for staff to work through while a wrongly matched one debits a family that never agreed to it.
Rebuilt subscriptions are anchored to the day each member is already billed on, so nobody is charged twice in the changeover month or skipped entirely. A member billed on the 31st is still billed in February.
A per-member board shows who has been imported, matched, subscribed, and — the only one that counts — actually charged successfully here. Nobody has to guess when it is safe to switch the old processor off.
Google Pay tokens cannot be moved between processors by anyone, and Apple Pay needs a separate request. Those members are named up front as the ones who will need to act, instead of being discovered when a charge fails.
When a migrated payment method declines, that member surfaces on the Fides direction as someone to contact — a targeted conversation rather than a blanket "everyone please re-enter your card" message to the whole roster.
There is no exception. Multi-tenancy enforced at the query rather than trusted to a filter someone remembers to add.
Eligibility checks, denials, imports, and administrative actions are written down. A member told "likely shared" and then denied can point at the record.
Without an AI key, triage notes say "not configured" and scoring is unaffected — it is never AI-dependent. Without queues, imports commit inline. Each fallback is logged rather than hidden.
If the limiter’s store is unavailable, logins are allowed. A broken limiter must never lock a ministry out on the day it matters.
Without a session secret, development uses a fixed key with a loud warning and production refuses to issue sessions at all.
The API, the application, the public site, and the background consumers are one Worker running next to the database, so there is no second service to keep in sync.
Per-ministry branding, plus pages and blocks with draft and publish states and a public read endpoint.
Pages, blocks, draft and publish, and the public read endpoint all exist. The builder for arranging them does not yet.
Administrators create users with a password today. An invitation where the invitee sets their own is the right pattern and is not built yet.
The demo ministry has five families in it, each carrying a different kind of trouble, and a full integrity report with real findings.