Person CRM
Find people by identity or profile fields. Read the fields your organization can see, alongside memberships and identity history.
The Data Hub ecosystem
SOURCE SNAPSHOT / AUG 2026
Many sources.
One clearer
picture.
Data Hub Admin brings people, audiences, and connected activity into an organization’s workspace. Behind it, dedicated services keep records consistent, control access, and turn data into insight.
A person, in context
Organization scoped
Forms
List uploads
Person recordIdentity + organization + visible fields
global_uuidEmailPhoneProfile
MembershipsLists & segments
ActivityDonations & events
IterableMessaging context
Know the person.
Understand the context.
The admin workspace and its services connect everyday operations with the underlying data. Each organization has its own access, settings, and view of the people it manages.
Lists & segments
Place records in audience context. Inspect list and segment memberships, get scoped member counts, and queue list subscription changes.
Connected activity
Bring donation history, activity timelines, Iterable messages, and subscription state into the person’s broader story.
Forms & pages
The admin frontend includes visual editing with Puck and Tiptap. Plans extend these workflows with a shared media picker and administrative APIs.
These are platform capabilities, not a claim that every screen is shipped. The supplied Person CRM documentation describes its API; its dedicated frontend is still a follow-up.
02 / From change to record
One update.
One update.
A deliberate path.
A person edit travels through the shared write pipeline, with an event ID connecting the request to downstream logs.
01
Verify the request
Confirm the caller’s identity, active organization, and required role before reading or changing a person.
02
Queue the change
Person CRM accepts the update and passes it to the smart-upsert service through Pub/Sub.
03
Process the record
The shared pipeline normalizes incoming fields and applies the update in AlloyDB, with configured integration work downstream.
04
Read the result
The client re-reads the person after processing. The request’s event ID connects the CRM and downstream audit entries.
Accepted ≠ finished
Person creates and edits are asynchronous. A successful acceptance means “queued for processing,” so the interface should communicate that state before showing a completed update.
Ask about the data.
Keep its boundaries.
Exophoric AI is the analytics layer. Its current API pilot uses Google Conversational Analytics to ask questions of organization-filtered BigQuery views, through an execution identity scoped to that organization.
Conversations belong to the user or API key that created them. The service keeps operational state in Supabase, with restricted audit and replay data in BigQuery.
Analytics and administration have different jobs
Person CRM reads exact records and accepts controlled changes. Exophoric AI answers analytical questions. A future admin agent is planned to use permission-checked APIs for its actions.
exophoricAI
API pilot
An example analytics question
“How have donations to our organization changed over the last three months?”
Organization viewsRead-only analysisBounded results
Data Pro supports fast and thinking execution profiles. Available models, modes, and customer rates come from the organization’s effective model catalog.
Illustrative question, not a live chat. The supplied docs identify the chat frontend as a pilot gap.
A few layers.
Clear responsibilities.
The frontend, access controls, operational records, and analytical history each have a defined place in the system.
Experience
Next.js + React
Mantine · TanStack Query · Puck · Tiptap
Mantine · TanStack Query · Puck · Tiptap
The administrative interface, data fetching, and visual content editors.
Identity
Supabase Auth
Active organization + roles
Active organization + roles
Signed identity and organization context determine what a caller may access.
Services
Cloud Run + Pub/Sub
Person CRM · smart-upsert · Exophoric AI
Person CRM · smart-upsert · Exophoric AI
Controlled APIs, queued person changes, and organization-scoped analytics.
Data
Supabase · AlloyDB · BigQuery
Configuration, operational person records, and analytical or audit data.
Supabase / application state
Organization configuration, roles, model catalog, AI turn state, and billing events.
AlloyDB / person records
Organization-scoped person data and the associations used by Person CRM.
BigQuery / analysis & history
Activity, summaries, restricted AI audit data, and billing mirrors.
Access is part
of the architecture.
Permissions travel with the request. Provider credentials stay in the backend.
- Organization first
Person queries bind the active organization. AI analysis uses filtered views and an organization-specific execution identity.
- Explicit roles and approved operations
Person fields follow the organization’s visibility rules. Curated Iterable administration also checks a separate operation policy.
- Traceable requests, bounded work
CRM requests emit audit records. Analytics enforce query and result limits; AI adds idempotency and a pre-turn monthly budget check.
05 / Where things stand
Built, piloting,
Documented service capabilities
Pilot / local implementation
Planned / follow-up
Built, piloting,
and up next.
The source documents include working services, local implementations, and future designs. Here’s how they fit together.
The operational foundation
- Person search, scoped fields, and memberships
- Queued person and list membership updates
- Donation and activity reads
- Person-level Iterable context and audit logging
The intelligence layer
- Exophoric conversational analytics API pilot
- Model catalog and usage ledger implemented locally
- Curated Iterable administration implemented locally
- AI usage counts explicitly marked as estimates
The next interfaces
- Dedicated Person CRM and AI chat frontends
- Broader forms, pages, lists, and segments admin APIs
- Admin Pro agent orchestration
- Reusable media library and edge abuse protection
Status reflects the supplied documentation snapshot, uploaded in August 2026; media plans date to July. This guide does not verify the live deployment state of the underlying Data Hub services.
What limitations matter when using Person CRM?
Creates and updates are queued. The MVP does not support clearing an existing field by sending a null or empty value. Erasure is a separate operation.
Activity timelines currently use the person’s current identifier and may omit older events stored under prior identifiers. Reads and counts for a partner-owned shared list still need additional authorization work.
The docs also keep merge approval disabled until the complete worker-owned merge flow is ready.
How mature are AI billing and safeguards?
The pilot records usage and applicable rates in an immutable ledger. Current per-turn token counts use an explicitly labeled estimate; the docs say these are not invoice-grade counts. External subscription billing and collection remain deferred.
Result bounds, query limits, idempotency, and organization budgets are documented inner safeguards. Cloud Armor is a follow-up. Durable audit delivery, production retention, and provider-conversation teardown also remain open work.
What is this guide based on?
A concise reading of the project’s supplied READMEs and design plans. Examples are illustrative; no live person records or operational metrics are shown.
Person CRM service READMEREADME(1).md · person reads, writes, Iterable, access, and current limitations.
Exophoric AI READMEREADME.md · analytics pilot, conversations, model catalog, usage, and pilot gaps.
AI integration + admin API planai_integration_plan.md · implementation stages and the boundary between analytics and administration.
Media assets + abuse protection plansdata-hub-media-assets-mvp-plan.md and ai-abuse-protection-v2.md · frontend context and planned extensions.