Every dollar spent here is a dollar not spent there.
Non-profits carry the same obligations as any business holding personal data, with none of the budget and considerably more turnover. The work is finding the security that costs nothing and being honest about the rest.
A donor database is no less sensitive than a bank’s customer file — and per the Privacy Commissioner of Canada, PIPEDA usually does not even cover a charity. The duty is real either way; the budget protecting it is a charity’s.
That gap is real and pretending otherwise helps nobody. The honest response is to be ruthless about sequence: take everything that is free first — and in the Microsoft non-profit programme a surprising amount is genuinely free — then spend only on the controls that measurably change your exposure. Most organisations we meet are paying full price for licences eligible for charity discounts, and missing controls that cost nothing to switch on.
Five failures common to charities.
Every one of these is a consequence of turnover, thin budget, or both. None require a large spend to fix.
| Failure | Why it happens here | What we do about it |
|---|---|---|
| 01Paying full price for Microsoft | Why it happens hereNobody applied for the non-profit programme, or applied years ago and never reviewed the pricing | What we do about itEligibility checked and claimed — usually the single largest saving available, and it recurs annually |
| 02Volunteers keep access indefinitely | Why it happens hereOnboarding is informal, offboarding does not happen, and nobody owns the list | What we do about itIdentity-driven lifecycle with dated accounts for term-limited roles, board members included |
| 03Donor data in spreadsheets on laptops | Why it happens hereThe database is inconvenient so people keep working copies | What we do about itStructured access with encryption enforced, so the convenient route is also the safe one |
| 04Board members on personal devices | Why it happens hereGovernance requires access, but the board is not staff and has no managed hardware | What we do about itConditional access with limited scope — documents reachable, systems not |
| 05Grant reporting depends on one person | Why it happens hereThe reporting workbook lives with whoever built it, and they are leaving | What we do about itDocumented, backed up, and structured so the next person can run it |
The licensing row usually funds a meaningful share of everything else on this list. It is also the one nobody volunteers to check.
What is free, and what is worth paying for.
The honest version, in order. If budget stops partway down this list, stop — do not skip ahead to something more visible.
The security stack
Free and non-negotiable: MFA
Included in every Microsoft plan, defeats most credential attacks, costs an afternoon to enable across the organisation. There is no argument for not having it.
High value: non-profit pricing
Microsoft retired its free Business Premium grant for charities in 2025; eligible registered charities now get deep non-profit discounts instead. Business Premium includes device management and advanced mail security you may currently be doing without.
Cheap and worth it: DNS filtering
Pennies per user per month, and it stops a large share of phishing before anyone has to make a judgement call. Best value per dollar in the whole stack.
Worth paying for: tested backup
Donor and grant records are irreplaceable and often the organisation’s single largest asset. This is the one line where economising is a false saving.
When the pressure actually arrives.
Non-profit IT demand follows the funding and campaign calendar rather than a flat monthly load.
Peak load
Donation platform, email volume and reporting all under strain at once, usually with volunteers who joined last week.
Receipting
Tax receipts and acknowledgements. A data error here becomes a compliance problem and a donor-relations one.
Reporting
Funder reporting against records that must be accurate and retrievable, sometimes years later.
Governance
Board turnover, new access, old access removed. The moment offboarding either exists or does not.
Improve
The only window for migrations and structural work. Worth protecting deliberately.
High turnover is the defining IT characteristic of the sector, and it makes identity the highest-leverage investment available. If joining and leaving are one action each, everything else stays manageable. If they are a checklist somebody remembers, access accumulates until an incident finds it.
For a charity, in this order.
We will tell you when you do not need us. Several organisations have taken the first two items, thanked us, and carried on alone — which is a perfectly good outcome. Further reading for charities: Business Premium versus Standard — the licensing decision that usually saves the most — and running awareness training that is not a checkbox. The layers behind this list are backup, the email gateway and Microsoft 365 administration.
The ones organisations actually ask.
If yours isn’t here, ask it directly — you’ll get an answer from an engineer, not a form letter.
We help you claim Microsoft’s non-profit discounts first, which is usually worth considerably more than any discount we could offer. Our own rates are our rates; we would rather be straightforward about that than pad a price and then discount it.
Dated accounts tied to the role, with an expiry set at creation. It means access ends by default rather than requiring somebody to remember, which is the only approach that survives real turnover.
Depends entirely on the platform and how it is configured. We will assess what you have and tell you honestly — including if the answer is that it is fine and you should spend the money elsewhere.
Yes, with scoped conditional access. Board members get what governance requires on their own devices without extending your perimeter to hardware you do not manage.
Yes. The first conversation is free and the first two recommendations usually cost nothing. If the honest answer is that you cannot justify a provider yet, you will hear that rather than a proposal.
Next
Spend it on the mission.
Twenty minutes. Tell us whether you have claimed Microsoft’s non-profit licensing — if not, that call has already paid for itself.