Home / Industries / Nonprofits & human services

IT and secure AI for nonprofits that can’t afford a bad day.

Nonprofits hold some of the most sensitive information in the community, often on donated laptops and a shoestring budget. You get enterprise-grade protection sized for a nonprofit, plus a safe way for staff to use AI.

  • Human services and disability service providers
  • Community mental health contract providers
  • Charities and foundations
  • Churches and faith-based organizations
  • Youth, education and arts organizations
  • Associations and membership groups

What makes nonprofit IT different

Most nonprofits run lean. The IT person is often whoever is most comfortable with computers, logins get shared between staff and volunteers, and the equipment is whatever was donated. None of that is a criticism. It’s what putting every possible dollar into the mission looks like.

The data doesn’t get a discount, though. Donor records, payment details, case notes and the personal information of the people you serve are exactly what attackers look for, and nonprofits are attractive targets because they’re assumed to be easy. Funders, auditors and cyber insurance applications increasingly ask the same questions: do you use multi-factor sign-in, are your backups tested, and who has access to what.

The goal is protection that fits the budget: use the nonprofit programs you already qualify for, close the gaps that matter most, and write it down so it survives staff turnover.

Rules you may answer to

Which of these apply depends on the services you provide and who funds them. Sorting that out, in writing, is part of the first assessment.

HIPAA
If you provide health, behavioral health or disability services billed to Medicaid or insurance, you are likely a HIPAA covered entity or business associate. That brings the Privacy, Security and Breach Notification Rules, including a documented risk analysis.
Michigan Mental Health Code
Agencies under contract with a county community mental health program must keep recipient information confidential under the Mental Health Code, alongside HIPAA, and meet the privacy and security terms in their provider contract.
PCI DSS
Card donations, event registrations and sales bring the payment card rules into scope. The simplest answer is usually keeping card numbers off your own systems entirely.
Grant and funder requirements
Government and foundation grants can carry their own data security and record-keeping terms. Read them before the grant report is due, not after.
Michigan breach notification law
Michigan law requires notifying people when certain personal information is exposed. A plan made in advance costs far less than one made during an incident.

Where nonprofits get hurt, and how I close the gap

Nonprofits are attacked like any business and defended with a fraction of the staff. These are the gaps that show up most, with the numbers behind them and what I do about each.

  1. Nearly 4 in 5nonprofits surveyed had at least one cyberattack in the past three years

    “Who would bother attacking us?”

    Plenty of people. Email attacks such as phishing and business email compromise were the most common, and attackers go after easy targets, not famous ones.

    What I doA short assessment of what sensitive data you hold, where it lives and who can reach it, followed by a prioritized fix list sized to your budget.

    Source: WaTech, on UC Berkeley CLTC’s CyberCAN Washington study (2026)

  2. 64%of nonprofits surveyed had no full-time IT or cybersecurity staff

    Nobody owns IT

    When IT is someone’s side job, updates slip, former staff and volunteers keep their accounts, and nobody notices the warning signs until something breaks.

    What I doManaged IT on a predictable monthly plan: patching, backups, account clean-up and monitoring, with one accountable person to call.

    Source: WaTech, on UC Berkeley CLTC’s CyberCAN Washington study (2026)

  3. $3.05Bin business email compromise losses reported to the FBI in 2025

    Fake invoices and payment changes

    A spoofed email from the executive director, or a “vendor” with new bank details, is how a single message turns into a lost grant payment or a payroll diversion.

    What I doA call-back rule for any payment change, multi-factor sign-in on email, alerts on suspicious mailbox rules, and training on the scams that actually target nonprofits.

    Source: FBI IC3 2025 Internet Crime Report, via McDonald Hopkins

  4. 99%of identity-based attacks are blocked by phishing-resistant multi-factor sign-in

    Free protections left switched off

    Many nonprofits already pay for security features they never turned on, or lost them quietly when their licenses changed.

    What I doTurn on the protections already included in your Microsoft 365 or Google Workspace, and confirm your licenses didn’t lose them at renewal.

    Source: Microsoft Digital Defense Report 2025

  5. 13,000nonprofits affected when one fundraising software vendor was breached

    Your donors’ data lives with your vendors

    In the Blackbaud breach, an attacker went unnoticed for three months and took unencrypted donor data. Federal regulators later ordered the vendor to delete data it no longer needed.

    What I doA review of every vendor holding donor or client data, the right contract terms, and a habit of deleting what you no longer need, so there’s less to lose.

    Source: Chronicle of Philanthropy, on the FTC’s Blackbaud order (2024)

Related services: Managed IT services · Network security & cybersecurity · Microsoft 365 & Google Workspace · Secure AI · Staff training

Where AI helps, and where it needs guardrails

AI can give a small team hours back every week. It also makes it very easy to paste someone’s case notes into a free chatbot.

Good places to start

  • Drafting grant narratives and reports from your own program summaries
  • Newsletters, donor thank-you letters and social posts
  • Meeting minutes and board packet summaries
  • Turning policies and procedures into plain-language staff guides
  • Volunteer scheduling, sign-up and intake forms

Keep out of AI tools unless approved

  • Case notes, assessments or anything that identifies the people you serve
  • Donor financial details and giving history
  • Any AI tool without a business agreement covering your data
  • Personal AI accounts staff or volunteers signed up for on their own

How a secure AI setup works

Put AI to work on the paperwork

The biggest win for most nonprofits isn’t a chatbot. It’s getting hours of re-typing, report-building and follow-up off your staff’s plate, inside tools covered by the right agreements.

Intake and document automation

AI that reads the forms, referrals and scanned paperwork you already receive and puts the details where they belong.

What it covers

  • Intake and referral forms read into your case management system
  • Scanned documents sorted and filed automatically
  • Eligibility and missing-information checks before a caseworker sees the file
  • Translation of client-facing documents, reviewed by a person

Best forAgencies where staff spend more time typing than serving.

  • Less re-typing
  • Faster intake
  • Cleaner records

Grant and donor insight

Your program and giving data, turned into the reports funders ask for and early signals about donors who are drifting away.

What it covers

  • Grant reports drafted from your own program data
  • Outcome dashboards for the board and funders
  • Donors likely to lapse, flagged while there’s time to reach out
  • Giving trends by campaign, season and channel

Best forDevelopment and program teams who rebuild the same reports every quarter.

  • Faster reports
  • Better retention
  • Clearer outcomes

How it gets set up

  • Client and health information only goes into tools covered by a signed agreement, a BAA where HIPAA applies.
  • Built on the Microsoft 365 or Google Workspace you already have, using nonprofit pricing where it exists.
  • A person reviews anything that goes to a client, funder or the board.

AI consulting & integration · Agentic operations

Common questions

We’re a small nonprofit. Do we really need this?

Size doesn’t change what the data is worth. A five-person agency with client records carries the same obligations as a large one, with fewer people to clean up after an incident. The work is scaled to match: most small nonprofits need a handful of fixes done well, not a big project.

What happened to Microsoft’s free nonprofit licenses?

Microsoft retired its free Microsoft 365 Business Premium grant, starting with renewals after July 1, 2025. Eligible nonprofits can still get up to 300 Microsoft 365 Business Basic licenses at no charge, plus discounts on paid plans. If your licenses changed at renewal, check that the security features you relied on didn’t quietly go with them.

Is there a free option for email and documents?

Eligible nonprofits can get Google Workspace for Nonprofits at no charge, including email on your own domain, shared drives and the Gemini app with enterprise-grade data protections. Microsoft’s free Business Basic licenses are the other common route. The right choice depends on what you use today and what your funders and partners expect.

Can our staff use ChatGPT?

Yes, with rules. Free and personal accounts shouldn’t see client or donor information. For work involving sensitive data, use a business-tier tool with a signed agreement that covers your data, backed by a short written policy that says what can go where.

Sources

  1. WaTech, on UC Berkeley CLTC’s CyberCAN Washington study (2026)
  2. FBI IC3 2025 Internet Crime Report, via McDonald Hopkins
  3. Microsoft Digital Defense Report 2025
  4. Chronicle of Philanthropy, on the FTC’s Blackbaud order (2024)
  5. Nonprofit Quarterly, Microsoft retires Business Premium grant (2025)
  6. Google, Workspace for Nonprofits edition
  7. Michigan Identity Theft Protection Act, MCL 445.72 (breach notice)

Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.

Other industries

Protect the mission’s data, too.

Tell me how your organization runs today. You’ll get a clear, prioritized list of what matters most, sized to a nonprofit budget.

Book a callSend a message