Reporting violence is a moment of maximum vulnerability. Protege treats it that way.
Protege is Barcarena's system for protecting children and adolescents from violence, in the Brazilian Amazon. I designed every interaction and experience, end to end: the identity, the citizen's guided report, the anonymous protocol, and the platform that unites every front of the protection network, from social assistance to police, around each case.
The person reporting is often in danger, on a shared phone, right now.
A report of violence against a child or adolescent is rarely filed from a calm place. It happens on a borrowed phone, over weak connectivity, by someone who may fear being seen typing, and who may not read comfortably. Every screen of Protege was designed against that reality: plain language, short steps, an anonymous path as a first-class citizen, and no dead ends.
The system also had to earn institutional trust. A report that disappears into an inbox teaches a city to stop reporting. So the design brief was double: dignity on the citizen's side, accountability on the municipality's side, held together by one protocol.
Mapping how reporting fails, before designing how it works.
The discovery phase audited the existing reporting landscape: state hotlines (180, 181, 190), police portals like DEAM Virtual, and international references such as Nigeria's iPROTECT. The failure patterns repeated everywhere: jargon-first forms, eligibility rejections after effort, no follow-up, and channels built for institutions rather than for the person in danger.
- Dead ends: flows that reject the report after the victim has already invested trust and time.
- Jargon walls: legal and police vocabulary as the price of entry.
- The silence after: no way to know if a report went anywhere, so people stop making them.
An identity that tells a child's ally: you can speak here.
Protege's identity had to do the opposite of police aesthetics. It speaks in the municipality's own green, uses warm, dignified photography of the city's children and families instead of stock fear imagery, and holds a plain-Portuguese voice that never interrogates. The functional color system is part of the identity: every violence typology and case status has a color a caseworker reads at a glance, on every surface of the platform.
- Institutional warmth: municipal green as trust, not authority; soft cards, generous type, zero badge-and-siren symbolism.
- Photography with dignity: children shown in life, not in victimhood.
- Color as language: one spectrum for typologies and statuses, consistent from citizen protocol to admin dashboard.
- Designed for the territory: the whole municipality on the map, riverine districts included.
"A report is not a form. It is a promise the city makes back."
Anonymous by right. Trackable by protocol.
The reporting flow is guided, short, and written in everyday Portuguese. Identification is optional and never a gate: the anonymous path receives the same care, the same routing, the same follow-through. At the end, every report becomes a protocol code the citizen can keep and check from any device, with status written in human language: received, under review, being handled.
- Guided, not interrogated: one question at a time, progress always visible, exit always safe.
- Anonymous first-class: no account, no phone number, no identification required to be heard.
- The protocol as covenant: a code that turns a cry for help into a trackable commitment.
The entire protection network, working the same case.
A report only matters if the right institutions act on it together. Protege is the shared workspace of Barcarena's whole protection network: social assistance (SEMAS, CREAS), education (SEDUC), health (SEMUSB), the civil police, the guardianship council (Conselho Tutelar), the specialized delegacia (DEACA), the children's rights council (CMDCA), and the Ministério Público. Each report is routed to named professionals across these fronts. Everything they do lands on the one timeline the case carries for life.
- One case, one timeline: every institution sees the same object; no parallel spreadsheets, no lost handoffs.
- Routing by typology: the violence type determines which fronts are convened.
- The case speaks the network's language: laudo, medida, ofício, escuta: official document types as first-class, attachable artifacts.
A report that moves, not a message that lands.
The other half of Protege is the municipal back office: triage, routing, and case management for the teams who act on each report. Every case travels an explicit pipeline (received → opened → initiated → routed → shelter → concluded), typed by the violence involved, so nothing sits unowned and nothing disappears.
- Accountable pipeline: seven case states, visible workload, no silent queues.
- Violence typology: physical, psychological, sexual, institutional, neglect; routing follows type.
- Shelter as a state: protection (abrigo) is part of the system's vocabulary, not an off-book exception.
- No silent queues: the platform itself escalates, flagging any report stalled for 15, 20, or 30 days.
Civic trust is the same architecture as machine trust.
Protege and Hai share a spine: a person acting under uncertainty, a system that must be believed to be used, and trust built through visible status, plain language, and follow-through. Designing for a victim in Barcarena and designing for a security analyst at a Fortune 500 — structurally, it's the same discipline, held to the same standard.