Managed IT Services for Nonprofits & Charities in the GTA
IT for charities and nonprofits: donor data, volunteers who come and go, and a budget that has to stretch. This page covers which rules apply, the attacks that target charities, and how to use the discounted Microsoft licensing well.
Donor data: which rules apply
A charity typically holds donor names, addresses, giving history and sometimes payment details, plus volunteer and client records that can be sensitive. PIPEDA applies to commercial activity; for many charities that covers things like selling or exchanging donor lists, while core charitable work may sit outside it. Donors and funders expect PIPEDA-level care either way, and a breach is reputational before it is legal.
Email to donors is also covered by Canada's Anti-Spam Legislation (CASL). The CRTC's guidance includes a specific position on registered charities sending fundraising messages; read it before you build an email list. This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.
The attacks that hit charities
Three come up again and again. First, a phished Microsoft 365 password on a board member's or executive director's account, used to send fake payment requests to staff. Second, a fake grant or donation that "overpays" and asks for a refund. Third, a lookalike domain used to solicit donations in your name.
The controls are cheap: multi-factor sign-in on every account including board members, a rule that no payment or refund goes out on an email instruction alone, and SPF, DKIM and DMARC on your domain so it cannot be spoofed. Our DMARC rollout guide walks through enforcement step by step.
Volunteers and the account lifecycle
Volunteers rotate faster than staff and often use their own devices. The usual result is shared mailboxes with passwords nobody changes, and former volunteers who can still open the donor spreadsheet in OneDrive.
Give volunteers named accounts with the minimum access, set an end date when you create them, and review who has access to donor and client files every quarter. Keep donor data in one system, not exported to personal laptops. For volunteers on personal phones, app protection policies can keep work data inside managed apps without taking over the device; see our BYOD guide.
Microsoft licensing for nonprofits
Eligible nonprofits can get Microsoft 365 through Microsoft's nonprofit program, with grants and discounts on business plans. Eligibility, the offers and the terms are set by Microsoft and change, so check that page rather than relying on a figure from us.
The licence matters less than the configuration. Many nonprofit tenants have the security features included and switched off. A sensible baseline: multi-factor sign-in for everyone, legacy authentication blocked, external sharing reviewed, and Microsoft 365 data backed up separately, because Microsoft's retention is not a backup (Microsoft 365 backup guide).
What funders, boards and insurers ask
Larger funders and cyber insurers increasingly ask whether you use multi-factor sign-in, back up and test restores, train staff, and have an incident plan. Boards ask the same after a sector peer is hit.
A short written answer for each, backed by what is actually configured, covers most of it. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations is a free, credible framework to report against. Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.
Questions nonprofits ask
If PIPEDA applies to the activity and the breach creates a real risk of significant harm, yes: to the Privacy Commissioner and to the people affected, and you must keep a record of every breach. The OPC's breach pages explain the test. Ask counsel how PIPEDA applies to your activities.
Yes, with limits: sign-in with multi-factor, access through the browser or managed apps, and no donor exports to local drives.
Multi-factor sign-in on every account, a payment-change callback rule, and a tested backup of Microsoft 365. Those three cover most of what actually goes wrong.
We do not publish pricing on this site. Ask us when you call and we will tell you plainly what applies.
Yes. Short, practical training on phishing and payment fraud works better than a long annual session; see our security awareness guide.
Related work.
- Case studyRecovering a Total ERP Database Outage in a Single MorningHow IT Rapid Support traced a total Spire database outage to a changed server network profile and had every affected workstation back the same morning.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related pages.
- ArticleCASL basics for business email and textsCanada's Anti-Spam Legislation applies to almost every promotional email, text and app message a business sends.
- ArticleIT and Cybersecurity Checklist for Nonprofits and CharitiesThe IT and security controls a charity or nonprofit needs: a systems inventory, donor data and CRM access, MFA, shared and volunteer accounts, offboarding, Microsoft 365…
- HubServicesManaged IT, security, incident response and forensics for businesses and private clients, from our offices in Vaughan and Vancouver. Pick the practice below, or call the 24/7 incident line at (289) 582-9930 if something is happening now.
- ToolWhat is missing from your managed IT quote?Two managed IT proposals can carry the same monthly price and cover completely different things.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.