Donor trust is your biggest asset. Protect the data behind it.

The short answer

Nonprofits hold donor names, addresses, giving histories and sometimes payment and client data, often with shared logins, volunteers coming and going and no full-time IT staff. Good nonprofit cybersecurity starts with a few inexpensive basics: one named account per person with multi-factor authentication, removing volunteers and staff the day they leave, keeping card data with your payment processor rather than in spreadsheets, backing up your donor database and files, and training people to spot donation and payment fraud.

Several technology programs help with cost. As of 2026, Google offers Google Workspace for Nonprofits at no charge to eligible organizations, and Microsoft offers eligible nonprofits up to 300 free Business Basic licenses plus discounts on paid plans. The rest of this article covers the risks, the programs worth claiming, and a priority list.

The risks that hit nonprofits hardest

• Shared and orphaned accounts. One “info@” login used by six people, and accounts for volunteers who left two years ago.
• Payment and grant fraud. Criminals impersonate the executive director, a board member or a vendor and ask for gift cards, wire transfers or a change of bank details. Business email compromise is one of the costliest crimes reported to the FBI.
• Donor database exposure. Exports of donor lists sitting in personal email or on home computers.
• Ransomware. Small organizations with no tested backups lose years of records.
• Website and donation form attacks. Card-testing bots and outdated plugins on the donation site.
• Personal devices. Volunteers and staff using their own laptops and phones with no screen lock or updates.

Free and discounted programs worth using

Programs change often, so confirm current terms and eligibility directly with each provider.

• Google for Nonprofits. Google lists Google Workspace for Nonprofits at no charge for eligible organizations once Google verifies their eligibility, plus discounts on higher Workspace editions. Google Ad Grants provides up to $10,000 per month in search ads for qualifying nonprofits.
• Microsoft for Nonprofits. Microsoft retired its free Business Premium grant in 2025. Eligible nonprofits can now get up to 300 free Business Basic licenses and discounts of up to 75 percent on many paid Microsoft 365 plans. Business Premium, which adds device management and stronger security features, is among the discounted plans.
• TechSoup. A long-running source of donated and discounted software and hardware for verified nonprofits.
• CISA free services and tools. CISA maintains a list of free cybersecurity services and tools, and offers resources for high-risk communities, including civil society groups.
• Cloudflare Project Galileo. Free website protection for eligible public-interest organizations at risk of online attack.

A practical note: free Business Basic licenses do not include desktop Office apps or device management. Many nonprofits mix free licenses for volunteers with discounted Business Premium for staff who handle donor or client data. Our comparison of Microsoft 365 and Google Workspace can help you choose a platform.

Protecting donor data in practice

1. Know where it lives. List every place donor data sits: CRM, email marketing tool, spreadsheets, payment processor, event platforms.
2. Keep card data out of your systems. Use a reputable payment processor and its hosted forms so card numbers never touch your website or files.
3. Limit access. Only staff who need the full donor database get it. Volunteers get the narrowest access that lets them do the job.
4. Stop the exports. Discourage downloading donor lists to personal devices. Share reports inside your platform instead.
5. Check your vendors. Make sure your CRM and email tools support multi-factor authentication and that it is turned on.
6. Plan for a breach. Know who you would call, including counsel, since state breach notification laws may apply to donor data.

Want a clear picture of your nonprofit’s risks? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Volunteers, boards and shared logins

Nonprofits have more people coming and going than most businesses. A few rules make that manageable.

• Give every regular volunteer their own account, even a free one, instead of sharing a password
• Use shared mailboxes for info@ and donations@ so people sign in as themselves
• Keep a simple list of who has access to what, and review it each quarter
• Remove access the day someone leaves, whether staff, volunteer or board member. Use a written offboarding checklist so nothing is missed
• Give board members a separate account for board materials rather than using personal email
• Use a password manager with shared vaults for the few accounts that truly must be shared

A priority list for a small nonprofit

1. Turn on multi-factor authentication for email, the donor CRM, banking and the website admin.
2. Replace shared logins with named accounts and shared mailboxes.
3. Set a rule: any request to pay, buy gift cards or change bank details is confirmed by phone using a known number.
4. Back up email, files and the donor database, and test a restore.
5. Keep computers and phones updated and use endpoint protection on organization devices.
6. Update the website, plugins and donation form, and add bot protection.
7. Run a short phishing awareness session for staff and regular volunteers each year.
8. Write a one-page incident plan with contacts for IT, your insurer and counsel.
9. Ask your insurer whether your policy covers cyber incidents, and what controls they expect.
10. Review access and settings once a year.

Questions your board should ask

Boards are responsible for oversight of risk, including technology risk. A few questions at one meeting a year keep security on the agenda without turning directors into IT staff.

• Who is responsible for our technology and security, staff, volunteer or provider?
• Is multi-factor authentication turned on for email, the donor database and banking?
• When did we last test restoring our backups, and did it work?
• What would we do, and who would we call, if donor data were exposed?
• Does our insurance cover a cyber incident, and do our answers on the application match reality?
• How do we remove access when staff, volunteers or board members leave?

Secure the donation website

Your website is often the first place donors share personal and payment details, and it is a common target.

• Keep the content management system, theme and plugins updated, and remove plugins you do not use
• Use your payment processor’s hosted or embedded form so card data never touches your server
• Turn on bot protection for donation forms to stop card-testing attacks, where criminals run stolen cards through small donations
• Protect the website admin login with multi-factor authentication and named accounts
• Back up the site and confirm your host monitors for malware

If your site is old or hard to update safely, our web design team builds WordPress sites that staff can edit and keep.

How JLB USA helps

JLB USA’s cybersecurity services include multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores, a written recovery plan and help with cyber-insurance questionnaires. We administer Microsoft 365 and Google Workspace and can work alongside an existing IT volunteer or staff member.

Keep reading

• Facebook business page hacked? How to recover it and lock it down
• Email security for small business: the layers you need and what to buy
• Cybersecurity for small manufacturers: ransomware, OT and supplier demands
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Managed IT services
• Microsoft 365 vs Google Workspace