For organizations

Before you share with us — read this.

If you run an Albanian-American organization, a church, a regional federation, or a foundation evaluating whether to point your members at the National Albanian Registry, this page exists for you. The four questions every serious community organization should ask before sharing data — and direct answers to each.

Last reviewed: May 2026

The four questions, and our answers.

Question 1

Who are the end users of registrant data?

Three groups, in order of access:

a.Public visitors — see only aggregate counts. Total registrants. Per-state numbers. Demographic distributions in our annual Impact Report. No individual records appear on any public page, ever, except the opt-in Founding 100 wall (first name, last initial, state) and the opt-in business directory at /sponsors.
b.The registrant themselves — full self-service control at /account. View, export, edit, or permanently delete their own record at any time, no email required, no questions asked.
c.NAR's eight-member volunteer board — named admins with tiered roles. Every read of an individual record is audit-logged. Every consequential action (data-policy change, mass communication, schema modification) requires 2-of-N approval — no individual board member, including the founder, can unilaterally export or share the registry. The audit log itself is append-only and tamper-evident at the database level. Governance log →

Question 2

Will you share registrant data with companies targeting Albanian communities?

No. Never sold. Never licensed. Never matched against advertiser databases. Never shared with marketing companies, data brokers, mailing-list aggregators, or anyone who pays for lists.

The only individual data ever published is the opt-in business directory at /sponsors — and that's a marketing channel that Albanian-owned business owners create for themselves, with information they choose to share. It's not a list we package, sell, or rent. Their listing comes off the moment they ask for it to come off.

Question 3

Will you share registrant data with other Albanian-American non-profits — VATRA, AANO, regional federations, churches, my organization?

Not in bulk. Ever. Even when the cause is good. Even when the partner is trusted. Even when our membership and yours overlap. The trust we ask of registrants only holds if it isn't optional.

What we will do:

Aggregate counts. Anyone — including peer organizations — can publish or use NAR's public aggregate counts. "X registrants in Greater Boston," per-state breakdowns, demographic distributions. The numbers are public, the methodology is public, and they're auditable. Use them for grant applications, advocacy work, anything.
One-at-a-time referrals with explicit consent. If a registrant tells us they'd like to be connected to your organization (a regional federation, a youth program, a scholarship fund, a language school), we'll pass that referral along — only with their explicit per-referral approval, only for that specific organization.
Joint events and announcements. If your organization runs an event for the Albanian-American community, we'll announce it on our events directory and in our newsletter. The registrants who want to attend will RSVP through your channels, not through ours.

If your organization wants to share data with us — your member list, your event attendees, your survey results — we can talk about how to do that under your privacy policy, with your members' consent, on terms you set. We'll mirror whatever consent rules you operate under. The flow goes both ways; the rule is the same.

Question 4

Will you share registrant data with the government — Albania, Kosovo, the U.S., anywhere?

Hard no. No government, foreign or domestic, gets individual registrant records.

This commitment is written into Article VII of our bylaws as a "sticky provision" — meaning amending it would require unanimous admin approval plus a 60-day public comment period. It can't be quietly relaxed. Bylaws Article VII →

Operationally, this means:

We don't collect immigration status, social security numbers, or fields a government might subpoena us for.
If we're ever compelled by a U.S. court order, we narrow the scope to the legal minimum, notify the registrant before disclosure unless under gag, and publish every request in our annual transparency report.
Foreign governments don't have jurisdiction over a U.S. 501(c)(3) holding U.S.-resident registrant data on U.S.-based servers. Our answer to a request from any foreign government will be: no.
If our 501(c)(3) ever winds down, the data is deleted as part of dissolution — never transferred to another entity, never sold, never inherited.

Other questions partner organizations ask

Where is the data physically stored?

Supabase Postgres in U.S.-East, encrypted at rest (AES-256). TLS for everything in transit. Heritage-survey responses are encrypted at the row level with a separate vault-managed key beyond the disk encryption — even a leaked database backup wouldn't expose the survey detail in cleartext. We don't replicate registrant data outside U.S. data centers. We don't use third-party data warehouses, analytics exports, or off-site copies.

Who has admin access — and how do you constrain them?

Eight named volunteer-board members. Magic-link only — no shared passwords, no service accounts. Roles are tiered (viewer / editor / admin / superuser) and every page in the admin console gates on the minimum role required. Every read of registrant data writes to an append-only audit log that no admin (including the founder) can modify or delete. Every consequential write — data-policy change, mass communication, schema modification, dissolution — requires 2-of-N approval recorded as a structured governance action with public visibility (or whistleblower-confidential when applicable). The full board roster is on /about and the governance ledger is at /governance.

What sub-processors do you use?

Database, auth, file storage: Supabase (U.S.-East). Hosting + CDN: Vercel (U.S.). Transactional email: Resend. Bot protection: Cloudflare Turnstile. Rate limiting: Upstash Redis. Error monitoring: Sentry. Donation processing (when applicable): Stripe. Physical certificate fulfillment (opt-in): Prodigi.

None of these vendors receive registrant data beyond what's strictly required to provide the named service. We're publishing a formal sub-processor list with Standard Contractual Clauses on this page in Q3 2026 — request a copy by email until then.

How does NAR get audited — internally and externally?

Internal: every administrative action is logged to an append-only audit table. Every governance decision (the equivalent of a board resolution) is filed as a public record with rationale, voting record, and timestamps. The bylaws require an audit-committee charter (Article XV) and an annual independent financial audit once revenue exceeds standard 501(c)(3) thresholds.

External: the application itself was independently audited in May 2026 — methodology, security posture, privacy architecture, data handling. The findings, severity ratings, fixes shipped, and outstanding items are all public-readable. Partner organizations evaluating NAR can request a walkthrough of the audit, same as a journalist would.

What happens if NAR is acquired, merges, or shuts down?

NAR is a 501(c)(3) public charity; it cannot be sold or acquired. If a future board ever determines NAR should dissolve or merge with another mission-aligned 501(c)(3), the bylaws (Article IX) require a registrant-notification period and a board supermajority. Registrant data is not part of any merger or transfer — at dissolution, the data is deleted as part of the wind-down, not handed to a successor entity. The certificates and verifiable credentials that have already been issued continue to verify independently of NAR's servers via the public DID document at /.well-known/did.json; that key remains valid for verification even after the organization no longer exists.

Can my organization endorse NAR, partner with NAR, or invite registrants to our events?

Yes to all three.

Endorsement. If your organization wants to publicly endorse NAR, we'd be honored — and we'll list your endorsement on /endorsements with the language you provide. We don't ask for anything in return except your honest read of our work; if you change your mind later, we take the endorsement down.

Partnership. Joint programming, shared advocacy work, joint research projects, co-hosted events — we're open to any of it. Email Iliriana, our Director of Community Outreach, and we'll set up a call to talk through what makes sense for both organizations.

Event invitations. Submit your event at /events/submit. We surface every approved Albanian-American community event on our directory and link interested registrants to your RSVP channel — they sign up through you, not through us.

Want to walk through this with us?

We'd rather have a 20-minute call than a back-and-forth thread. If your organization is evaluating NAR — for endorsement, partnership, registrant referral, or just to vet us before you mention us to your members — we'll get on the phone with you the same week.

Email us to set up a call Read the full bylaws →

This page exists because Massachusetts Albanian-American Society asked us these exact questions in May 2026 before sharing data, and the answers deserved to live somewhere durable rather than in an inbox. If you're a leader at another community organization and the page misses something you'd want answered, email us — we'll add it.