Drawing 02.3, nonprofit platform
No More Fatherless
Grant intake and administration for a 501(c)(3) that funds adoptions and walks with foster youth. Families apply in minutes with no account, the team reviews and awards from one place, and approved families send their receipts through a private link.
| No. | Part | What it does here |
|---|---|---|
| 1 | Browser | Families apply with no account and send receipts by emailed link; admins sign in by magic link. |
| 2 | EventBridge | A daily call that clears abandoned receipts, prunes guard rows, and sends deadline reminders. |
| 3 | CloudFront | TLS, the www redirect, and the secret origin header; it has no route to the receipts bucket. |
| 4 | Next.js on Lambda | The application, the receipts page, and the admin in one container, with secrets read from SSM at start. |
| 5 | Receipts bucket | Private S3: presigned uploads in, an admin-gated stream out, and every read logged. |
| 6 | Neon Postgres | Grants and their questions, applications, hashed access tokens, the audit trail, and the rate limits. |
| 7 | SendGrid | Admin sign-in links, receipt links, and deadline reminders. |
Why it exists
No More Fatherless began in 2019 as a ministry of The Bridge Church and is now an independent 501(c)(3) that gives grants to adoptive and foster families. Its grants have to reach families in a hard season, and a small team reads every application. That called for an application a family can finish without making an account, a review the team can keep up with, and a record of what each family was asked and paid that still holds up years later.
How a grant moves
The team sets up each grant itself: when it is open, the largest award, how long families have to send receipts, and its own questions. The same rules check the form in the family's browser and again on the server, so the two can never disagree. A family applies with no account, and spam is turned away quietly: a hidden field only bots fill in, and a check on how fast the form was filled, drop junk before anyone has to review it.
Questions are archived, never deleted, and every answer keeps its own copy of the question it answered, so rewording a question later can never change what an applicant was asked. That matters two years on, when a board member asks what a 2026 applicant agreed to.
Receipts come after approval. The family gets an emailed link that expires with their receipt window, and only a scrambled copy of the link is stored, so a copy of the database cannot be used to open it. Each receipt goes from the browser straight into private storage on AWS, through a five-minute upload permission sized to that one file. That storage is not on the public web at all; the only way out is a page that checks for a signed-in admin, and every read is logged, because a nonprofit that cannot say which receipts a leaked password reached cannot tell the families in them. A daily job clears abandoned uploads and sends one deadline reminder per family.
The steps a grant goes through
An application moves through fixed steps: received, checked with the family's agency, approved, receipts sent, receipts approved, and paid. It can be declined or withdrawn at any point before the end. The one step back is when the team reopens a family's receipt window.
When the team approves a grant, it sets the amount and the receipt window, and that deadline is copied onto the application, so editing the grant later cannot move a deadline a family was already told. The approved amount and the amount paid are kept apart, because they can honestly differ, and receipts that go over the approved amount raise a warning instead of blocking the family.
What the team works from
One admin holds review, awards, and receipts, with an audit trail of what changed and who changed it. The export is a spreadsheet file, and when it covers a single grant, each of that grant's questions gets its own column. The team signs in by an emailed link, and only addresses on a short allow-list can.
What it does
- Grants with their own questions, windows, and award limits
- Applications with no account, for a whole family
- Spam turned away before review by a hidden field and a fill-time check
- Receipts by private link after approval
- Review, awards, and CSV export in one admin
- Sign-in by emailed link for an allow-listed team
Screenshots
Something like this on your list? Tell us about it.
Talk about a build like this