App Reference | Brother's Keeper

1. Overview & Mission

Brother's Keeper is a confidential peer-to-peer support platform for first responders (law enforcement, fire, EMS, dispatch, corrections). A responder in distress connects anonymously to a vetted, trained Peer Specialist over secure messaging or voice. The platform emphasizes responder anonymity, mandatory-reporting compliance, a Duty to Act safety protocol, audited access to any identity data, and admin-managed vetting, training, and crisis resources.

The Keeper intermediary role was removed to simplify the architecture to two primary user types: Responder and Peer Specialist, plus Admin and Senior Admin management roles.

2. Roles & Access

Responder (anonymous help-seeker)

A first responder who seeks confidential peer support. Connects via an anonymous session ID (anon_<id>) or a registered user account. Identity is protected by design; real identity is only stored in ResponderProfile (admin-only) and revealed only via an explicit, audited "Share Identity" action.

Peer Specialist

A trained, vetted peer who provides support over secure messaging and voice. Has a PeerSpecialist profile, credentials, skills, badges, duty/availability schedule, and training completions. Matched to responders by agency type, incident specialization, and keywords.

Admin

Manages peer approvals, credentials, training content, crisis resources, agencies, feedback, sessions, and Duty to Act alerts. Access to responder identity data is logged (ResponderProfileAccessLog, AdminAuditLog).

Senior Admin

An elevated admin who can invite and approve other admins via secure, email-verified, expiring invitations (AdminInvitation). Bootstrapped via the setupSeniorAdmin function.

3. Pages

The app has 44 page routes plus several public routes. Grouped by audience:

Public / Marketing

Welcome — Landing screen with options to connect to support, view how it works, or access the donate/contact pages.
Home — Secondary home/tab screen.
About — Mission and overview of the Brother’s Keeper platform.
HowItWorks — Explains the confidential peer support flow for first responders.
Donate — Public donation page for the foundation, linking to a third-party donation portal with tax-deductibility info.
ContactForm — Public intake form capturing organization interest (OrganizationContact leads) via QR codes.
conference-survey — Mobile-first public intake survey for the KY State FOP Conference.
PrivacyPolicy — Full data collection, security, retention, and rights policy with state-specific compliance (CCPA/CPRA) and mandatory reporting exceptions.
TermsOfService — Legal agreement covering service limitations, emergency protocols, mandatory reporting, and liability waivers.
SmsOptInPolicy — SMS opt-in consent and policy page.

Responder (help-seeker) flow

ResponderHome — Responder dashboard — start a support session, view crisis resources, schedule follow-ups, set goals, and manage account.
ConnectOptions — Chooses support type (message/voice) and triggers peer matching; displays matched peer and initiates a session.
Connecting — Transition/holding screen while matching a peer specialist.
LiveSession — Responder-facing live chat: messages, quick responses, resource recommendations, share-identity toggle, schedule follow-up, end session.
SessionEnded — Post-session screen with goals, feedback, and resource recap.
SessionFeedback — Responder rates the session and optionally allows testimonial use.
MyResources — Responder’s saved/recommended crisis resources.
ResponderProfileSetup — Responder creates/edits their (admin-protected) identity profile.
PersonalSubscription — Optional personal subscription/checkout for responders.
CrisisResources — Browseable national and local crisis resources (hotlines, mental health, substance abuse, etc.).
DownloadExpectationsFlyer — Downloads a PDF expectations flyer for responders.

Peer Specialist flow

PeerLogin — Authentication entry for peer specialists.
PeerSetup — Invitation-gated profile creation: agency type, years of service, expertise, identity document upload, reporting acknowledgment.
PeerPending — Shown while a peer’s application awaits admin approval.
PeerHome — Peer dashboard — toggle duty, view active session, badges, hours, training progress.
LiveSupport — Peer-facing live support console: messages, typing indicator, quick responses, flag session, Duty to Act protocol, escalation, session review.
SessionReview — Peer logs a session summary, outcome, key topics, and follow-up notes (SessionHistory).
PeerCredentials — Peer uploads and tracks certifications/licenses/training for admin verification.
PeerTraining — Lists available training modules and sessions.
TrainingModule — View/complete a single training module with documents, videos, and quiz.
MyProgress — Peer dashboard of training completions, session history, badges, and metrics.
PeerOnboardingGuide — Guide for newly approved peer specialists.

Admin flow

AdminLogin — Session-scoped admin authentication entry (the app’s landing page).
AdminSetup — Invitation-gated admin account setup.
AdminPending — Shown while an admin awaits senior-admin approval.
AdminDashboard — Central admin console: peer approvals, credentials, skills, training, resources, agencies, feedback, sessions, Duty to Act alerts, invitations, users, metrics, checklist.
AdminGuide — Reference guide for administering the platform.
AdminRecruitment — Tools for recruiting peers (invitation letters, flyers).
MakeMeSeniorAdmin — Bootstraps a senior admin (guarded).
AccountSettings — User account settings.
StateReportingReference — Reference for state-specific mandatory reporting laws.
ResourceUpdateGuide — Guide for keeping crisis resources current.
SpecialistInterfaceGuide — Guide explaining the specialist (peer) interface.
TestSpecialistInterface — Developer/utility page to log in as a demo peer for testing.
FlowTester — Developer utility to navigate and test registration/onboarding flows and quick-jump to any route.
RecruitmentFlyer — Generates/displays a peer recruitment flyer.
PeerInvitationLetter — Generates a peer invitation letter.

Onboarding & shared

Register — Registration entry routing users by role.
OnboardingFlow — Multi-step onboarding coordinator.
TermsAcceptance — Requires acceptance of Terms of Service before proceeding.

Public routes (no auth)

/Donate, /ContactForm, /conference-survey, /PrivacyPolicy, /SmsOptInPolicy, and this /AppReference page. All other routes require authentication.

4. Data Entities

28 custom entities (plus the built-in User entity). Each record carries id, created_date, updated_date, created_by_id automatically.

ResponderProfile

RLS: read: admin · create: authenticated · update: owner · delete: admin

Anonymous responder’s real identity. Admin-only read; the core protected responder-identity record.

user_id, full_name, agency_name, agency_type, years_of_service, state, rank_or_title, contact_email, phone, preferred_contact, emergency_contact_name, emergency_contact_phone, notes

PeerSpecialist

RLS: none (readable for matching/display)

Peer specialist profile. identity_doc_url is stripped from match results returned to responders.

user_id, name, state, is_on_duty, is_approved, agency_type, years_of_service, why_become_peer, profile_image_url, identity_doc_url, shift_start, total_hours_on_duty, about_me, biography, areas_of_expertise, experience_highlights, certifications_summary, incident_specializations, availability_schedule, mandatory_reporting_acknowledgment, reporting_acknowledgment_date

PeerCredential

RLS: none

Verifiable credentials uploaded by peers for admin review.

peer_id, credential_type (certification/training/license/other), credential_name, issuing_organization, issue_date, expiration_date, document_url, status (pending/approved/rejected/expired), admin_notes

PeerSkill

RLS: none

Peer skills that admins can verify.

peer_id, skill_name, category (communication/crisis_management/counseling/trauma_support/conflict_resolution/active_listening/other), is_verified, verified_by, verified_at

PeerBadge

RLS: none

Achievement badges awarded to peers.

peer_id, badge_type (first_session, 10/50/100_sessions, rising_star, highly_rated, excellence, trusted_advisor, 500_hours), earned_date, badge_name, badge_description

PeerInvitation

RLS: none

Invitations sent to prospective peer specialists.

email, invitation_token, invited_by, status (pending/accepted/expired), expires_at, accepted_at

SupportSession

RLS: none (relationship-based — residual exposure)

A live or closed support session linking a responder and a peer.

responder_id, peer_id, keeper_id (legacy), status (pending/active/closed), session_type (message/voice), ended_at, recommended_resources, session_keywords, is_admin_session, evidence_hold, evidence_hold_reason, evidence_hold_at

SessionMessage

RLS: none (relationship-based — residual exposure)

Ephemeral chat messages within a session. Auto-cleaned after sessions unless an evidence hold is active.

session_id, sender_role (responder/peer), content

SessionHistory

RLS: read: owner+admin · create: owner · update/delete: admin

Peer-authored summary of a completed session.

session_id, peer_id, duration_minutes, message_count, session_summary, key_topics, resources_shared, outcome (positive/neutral/needs_followup), follow_up_notes

SessionFeedback

RLS: read: owner+admin+approved-testimonials · create: owner · update/delete: admin

Session ratings and optional admin-approved testimonials.

session_id, peer_id, role (responder/peer), rating, comment, flagged_issue, issue_description, allow_testimonial, testimonial_approved, testimonial_approved_by

SessionFlag

RLS: none

Peer flags a session for admin review.

session_id, peer_id, reason (complex_case/needs_guidance/ethical_concern/follow_up_needed/other), notes, status (pending/reviewed/resolved), reviewed_by, reviewed_at

EscalationRequest

RLS: none

Legacy escalation workflow (keeper role removed).

session_id, keeper_id (legacy), peer_id, status (pending/approved/denied/completed), reason, responder_notified

ScheduledSession

RLS: none

Responder-requested follow-up/check-in sessions with reminder emails.

responder_id, peer_id, scheduled_date, status (pending/confirmed/completed/cancelled), session_type (follow_up/check_in), previous_session_id, responder_email, reminder_sent, notes, actual_session_id

DutyToActAlert

RLS: read/create/update/delete: admin

Duty to Act protocol alert. Stays active until two admins confirm safety. Triggers evidence hold on the session.

session_id, flagged_by_user_id, flagged_by_role (peer/keeper/admin), state, reason, details, location_data, status (active/resolved), admin_acknowledgments, resolved_at, resolution_summary, admin_notified_at, emergency_services_contacted, review_meeting_id

DutyToActReviewMeeting

RLS: none (admin use)

Weekly review meeting record discussing active Duty to Act alerts.

meeting_date, week_start, week_end, attendees, alerts_reviewed, status (scheduled/completed/cancelled), meeting_notes, action_items, completed_at

ResponderProfileAccessLog

RLS: read/create: admin · update/delete: none

Audit trail of every access to responder identity data.

accessed_by_user_id, accessed_by_email, accessed_by_name, action (list_all/view_single), target_profile_id, target_responder_name, ip_address, reason

AdminAuditLog

RLS: read/create: admin · update/delete: none

Audit trail of admin actions (approvals, rejections, message deletions, etc.).

admin_id, admin_email, action, target_type, target_id, details, ip_address

AdminInvitation

RLS: read/create/update/delete: admin

Secure, expiring, email-verified invitations to create admin accounts. Email-match enforced on acceptance.

email, invitation_token, invited_by, status (pending/accepted/expired), expires_at, accepted_at, auto_approve

Agency

RLS: none

Registered first-responder agencies with join codes.

name, agency_code, agency_type, contact_name, contact_email, contact_phone, location, user_limit, is_active, notes

OrganizationContact

RLS: none

Public lead capture (ContactForm + conference survey) for organizations interested in the platform.

full_name, title_rank, email_work, email_personal, phone_work, phone_personal, organization, staff_quantity, has_peer_support_team, peer_support_team_size, willingness_to_use, pilot_interest, notes

CrisisResource

RLS: none

Crisis resources and hotlines shown to responders and auto-recommended in sessions.

name, category (mental_health/substance_abuse/suicide_prevention/financial_aid/family_support/legal_assistance/trauma_support/general), phone_number, website, description, availability, scope (national/local), location, is_active, sort_order

TrainingModule

RLS: none

Training content with optional quizzes.

title, description, category, is_required, order, content_type (document/video/mixed), document_urls, video_urls, estimated_duration_minutes, has_quiz, quiz_questions, passing_score, is_active

TrainingSession

RLS: none

Scheduled live training sessions, optionally with Google Meet links.

title, description, instructor, session_type (virtual/in_person/hybrid), scheduled_date, duration_minutes, location, meet_link, calendar_event_id, max_participants, registered_peers, status (scheduled/in_progress/completed/cancelled), materials_url

TrainingCompletion

RLS: none

Tracks each user’s progress on training modules.

peer_id, profile_id, user_role (peer/keeper-legacy), module_id, status (not_started/in_progress/completed/passed/failed), started_at, completed_at, quiz_score, quiz_attempts, time_spent_minutes

TrainingFeedback

RLS: none

Feedback on training modules.

module_id, profile_id, user_role (peer/keeper-legacy), rating, what_worked, what_could_improve, additional_comments, would_recommend

GoLiveChecklist

RLS: none

Pre-launch readiness checklist.

category (legal/safety/vetting/technical/operations/content/marketing/financial/monitoring), priority (critical/high/important), item, is_completed, completed_by, completed_date, notes, sort_order

AlertEmail

RLS: none

Recipients of admin alert notifications (e.g., emergency/Duty to Act).

email, name, is_active

ResponderGoal

RLS: read/update/delete: owner+admin · create: owner

Responder-set goals, often created post-session.

responder_id, session_id, goal_text, category (self_care/professional/personal/health/relationships/other), is_completed, completed_date, target_date, notes

5. Backend Functions

50 serverless backend functions (base44/functions). Grouped by purpose:

Invitations, Access & User Management

setupSeniorAdmin — Bootstraps the first senior admin account.
sendAdminInvitation — Senior admin sends an expiring admin invitation to an email.
validateAdminInvitation — Validates an admin invitation token (via service role).
acceptAdminInvitation — Accepts an admin invitation after verifying the authenticated user’s email matches the invitation.
sendPeerInvitation — Admin sends a peer specialist invitation.
manualInviteUser — Manually invites a user with a given role.
suspendUser — Suspends a user account.
fixAdminUser — Repairs/normalizes an admin user record.
getResponderProfiles — Senior-admin-only function to list responder identity data; logs every access.
revealResponderIdentity — Audited disclosure of a responder’s identity within a session.

Matching, Sessions & Escalation

matchPeerSpecialist — Matches an available approved peer to a responder by agency type, incident specialization, and keywords; requires auth and strips identity_doc_url.
alertAdminNoPeers — Notifies admins when no peer is available for a responder.
requestEscalation — Legacy escalation request (keeper role removed).
respondToEscalation — Responder-side response to an escalation (legacy).
cleanupStaleSessions — Closes sessions stuck in pending/active states.

Duty to Act & Emergency

alertDutyToAct — Initiates a Duty to Act protocol; places an evidence hold on the session.
acknowledgeDutyToAct — Records an admin acknowledgment (two required to resolve).
notifyAdminDutyToAct — Notifies admins when a Duty to Act alert is raised.
notifyAdminDutyChange — Notifies admins of duty-status changes.
dutyToActReminder — Scheduled reminder for unresolved Duty to Act alerts.
generateDutyToActImages — Generates visual assets for the Duty to Act protocol.
flagSessionEvidenceHold — Toggles evidence hold on a session.
sendEmergencyAlert — Sends an emergency alert to admins.
sendTestAlert — Sends a test alert for verification.

Messaging & Realtime

notifyPeerOfNewMessage — Notifies the assigned peer of a new responder message.
cleanupSessionMessages — Deletes ephemeral messages after a session (unless evidence hold).
deleteOldMessages — Bulk-deletes aged messages.
demoPeerBot — Automated demo peer responses for testing/demo sessions.

Training & Resources

createTrainingWithMeet — Creates a TrainingSession and a linked Google Calendar/Meet event.
notifyTrainingReminders — Sends training reminders to peers.
seedTrainingModules — Seeds default training modules.
seedCrisisResources — Seeds default crisis resources/hotlines.
autoRecommendResources — Recommends crisis resources to a session based on keywords.

Notifications & Feedback

sendSessionReminders — Sends scheduled-session reminders to responders.
notifyAdminFlaggedFeedback — Notifies admins of flagged session feedback.
notifyAdminNewCredential — Notifies admins when a peer submits a new credential.
checkAndAwardBadges — Evaluates and awards peer badges.

PDF / Document Generation

generateBetaRecruitmentPDF — Generates a beta recruitment document.
generatePeerRecruitmentPDF — Generates a peer recruitment flyer.
generateExpectationsFlyer — Generates the responder expectations flyer.
generateLegalConsultationPDF — Generates a legal consultation document.
generateResponderQuickGuide — Generates a quick-start guide for responders.
enhanceLogo — Processes/enhances the app logo asset.

Payments & Subscriptions

createPersonalSubscriptionCheckout — Creates a Stripe checkout session for a personal subscription.
stripeWebhookUserSubscription — Stripe webhook handler for subscription lifecycle events.

Seeding, Load Testing & Utilities

seedDemoPeers — Seeds demo peer specialist accounts.
seedGoLiveChecklist — Seeds the go-live checklist items.
runLoadTest — Runs a load test against the app.
scheduledLoadTest — Scheduled load test runner.
testTwilio — Tests Twilio SMS configuration.

6. Key User Flows

Responder connects to support

Welcome/ResponderHome → ConnectOptions (choose message/voice) → matchPeerSpecialist (auth-checked, identity_doc_url stripped) → Connecting → LiveSession (realtime messaging, quick responses, auto-recommended resources, optional share-identity) → SessionEnded → SessionFeedback → optional ResponderGoal creation.

Peer provides support

PeerLogin → PeerSetup (invitation-gated, identity doc + reporting acknowledgment) → PeerPending (admin approval) → PeerHome (toggle duty) → LiveSupport (messaging, typing, quick responses, flag session, Duty to Act, session review) → SessionReview logs SessionHistory; badges awarded by checkAndAwardBadges.

Duty to Act protocol

Peer/admin triggers alertDutyToAct → evidence_hold set on SupportSession (messages preserved) → DutyToActAlert created → admins notified (notifyAdminDutyToAct, optionally 911/988) → two admin acknowledgments via acknowledgeDutyToAct → alert resolved → reviewed in weekly DutyToActReviewMeeting.

Admin onboarding

Senior admin sends AdminInvitation (expiring token) → invitee opens AdminSetup → validateAdminInvitation (service role) → acceptAdminInvitation verifies email match → account created → AdminPending until senior admin approves (if not auto_approve) → AdminDashboard.

Responder identity access (audited)

Admin opens responder data in AdminDashboard → getResponderProfiles (senior-admin only) → records ResponderProfileAccessLog with admin identity, IP, and reason → revealResponderIdentity within a session also audited.

Public lead capture

Visitor opens /ContactForm or /conference-survey → submits OrganizationContact record (no auth) → admins review leads in AdminDashboard.

7. Security Model

Row-Level Security (RLS) and access controls per entity and function:

Responder identity (ResponderProfile) is admin-only read; owner may create/update; admin may delete. All access is logged.
ResponderProfileAccessLog and AdminAuditLog are admin-only read/create, immutable.
DutyToActAlert (responder crisis location/details) is admin-only across all operations.
ResponderGoal, SessionHistory: owner + admin read; admin update/delete.
SessionFeedback: owner + admin + approved-testimonials read; admin update/delete.
AdminInvitation tokens are admin-only; acceptance requires the authenticated user’s email to match the invitation email (prevents token theft → privilege escalation).
matchPeerSpecialist requires authentication and strips identity_doc_url from results returned to responders.
AdminLogin uses sessionStorage to enforce fresh authentication per session and prevent persistent tokens.
Residual exposure: SupportSession and SessionMessage have no RLS because access is relationship-based (a session’s responder and assigned peer both need full read), which per-record RLS cannot express. Recommended remediation: ownership-verified backend functions for message/session access with admin-only RLS.

8. Tech Stack

React + Vite + Tailwind CSS + shadcn/ui (JavaScript, ESM).
Base44 BaaS: auth, entities (Mongo-style SDK), integrations, hosting; publish to iOS/Android from the same code.
State: @tanstack/react-query; forms: react-hook-form; routing: react-router-dom; icons: lucide-react; charts: recharts; 3D: three.js; maps: react-leaflet; drag-and-drop: @hello-pangea/dnd; markdown: react-markdown; rich text: react-quill.
Integrations: InvokeLLM, UploadFile/UploadPrivateFile, CreateFileSignedUrl, ExtractDataFromUploadedFile, SendEmail, SendPushNotification, GenerateImage, GenerateSpeech, GenerateVideo, TranscribeAudio.
Payments: Stripe (personal subscriptions).
SMS alerts: Twilio (TWILIO_ACCOUNT_SID secret configured).
Realtime: entity subscriptions for live session messaging.
PWA: manifest, service worker, installable; safe-area insets for iOS.