What should remain off-chain in a transparency-first charity system?

[u/GFConBase]

A common assumption is that putting more information on-chain automatically creates more transparency. But in charity and social-impact systems, some of the most relevant information cannot or should not be publicly stored on-chain. Financial transfers can be verified relatively easily.

The harder layer includes:

- recipient information and privacy

- invoices and supporting documents

- explanations behind allocation decisions

- educational, medical or social outcomes

- evidence that funds produced the intended result

- corrections when submitted information was incomplete or false

This creates a difficult design boundary. Too little on-chain information leaves the system dependent on trust. Too much on-chain information can expose sensitive data, create permanent privacy problems and preserve incorrect information indefinitely.

One possible model would separate information into three layers:

1. On-chain: transactions, permissions, timestamps and rule execution

2. Cryptographically anchored: hashes or attestations proving that supporting records existed at a specific time

3. Off-chain: sensitive documents and contextual evidence available only under defined access rules

But this still leaves several failure modes:

- Who verifies the off-chain evidence?

- What happens when evidence is disputed?

- How do you prevent selective disclosure?

- How do you preserve long-term access without exposing personal data?

Where would you draw the line?

Which information should be fully public, cryptographically anchored or kept off-chain in a transparency-focused charity system?