What a nonprofit's IT has to handle
Most nonprofits run on a donor database or CRM, an online giving platform, email and file sharing, accounting software, and sometimes case management for the people they serve. Each holds information that donors and clients trust you with: names, addresses, giving history, payment details, and in some programs health or family information.
The people side is harder than the technology. Staff turnover is high, volunteers come and go, board members use personal email, and shared logins are a common habit. Nobody can tell who did what, and nobody can remove one person's access cleanly. Nonprofits receive the same phishing and fake invoice emails as any business, often with fewer defenses.
- Individual accounts for staff and regular volunteers, not shared passwords
- Multi-factor sign-in on email, the donor database and the giving platform
- Access removed the day someone leaves, using a simple checklist
- Organization accounts for board members, instead of board files forwarded to personal email
Microsoft nonprofit licensing changed
Microsoft retired its free Microsoft 365 Business Premium and Office 365 E1 grants for nonprofits effective July 1, 2025. Each organization's granted licenses expired at its next renewal on or after that date. Microsoft continues to donate up to 300 Business Basic licenses and offers Business Premium at a discount of up to 75 percent.
Business Basic covers email, Teams and the web and mobile versions of the Office apps, but it leaves out the device management and advanced security tools that came with Premium. The right answer for most organizations is a mix: Premium for staff who handle donor data or finances, Basic for everyone else. Our article on what changed in Microsoft nonprofit licensing walks through the decision.
Protecting donor and client data
If you take donations online or over the phone, card security rules apply. Most organizations meet PCI DSS most easily by using a payment platform that collects card numbers so they never touch your own systems, and by never writing card numbers down or emailing them.
Nonprofits that receive federal grants also have a duty under the Uniform Guidance (2 CFR 200.303) to take reasonable measures to safeguard protected personally identifiable information. Some funders and partner agencies add their own requirements, especially for programs that serve children, health clients or families. And California's breach notification law applies to nonprofits as well as businesses.
None of this requires an enterprise budget. Individual accounts, multi-factor sign-in, encrypted laptops, tested backups and short staff training cover most of the risk at little cost.
A budget your board can predict
Break-fix IT is hard to budget: nothing for months, then a large bill when a server fails or a laptop is infected. A predictable monthly plan turns IT into a line item the board can approve once a year, and pays for prevention instead of emergencies. See our comparison of break-fix and managed IT.
We also help plan replacements ahead of time, so aging laptops and network equipment show up in next year's budget instead of as a surprise. When a grant funds new equipment, we help you buy what the program actually needs and keep the records the funder asks for.
How GlobeVM supports a nonprofit
On top of our standard security, nonprofits get licensing guidance so you use every donated license you qualify for, onboarding and offboarding for staff and volunteers, secure setup of your donor database and giving platform, and backups for donor and financial records.
When a staff member or volunteer needs help, they reach a person in Los Angeles in under 15 minutes, in English or Farsi.