IT for Nonprofits: Donor Data, Handover, and Security on a Tight Budget

An association's IT inventory is usually modest: a few computers, a printer, a website. The responsibility it carries is not: thousands of donors' identity and contact details, membership dues records, sensitive aid applications. And the structure runs on a fragility companies do not have — volunteer labour and periodic board changes. The general assembly ends, the board changes, and the new team meets the same question at its first meeting: "Who had the website password?"

Rule One: Accounts Belong to the Organisation, Not to People

The most common and most expensive nonprofit IT problem is not technical: the domain is registered to the former chair's personal email, the social account was opened by a volunteer three terms ago, the donation platform's login lives on a bookkeeper's phone. The people mean well, but life moves — people fall out, move away, pass away — and the organisation's digital assets become unreachable. The fix is written into the founding order, not the handover day:

• A corporate email roof: the organisation's domain and role addresses under it (chair@, treasurer@, contact@) — every critical account opens with these, never with personal addresses.
• An access inventory: which accounts exist, which role owns each, who holds rights — a one-page list attached to the general assembly's handover file.
• A password vault: shared access lives in the vault; handover is the transfer of vault rights — not of passwords written on paper.
• The two-administrator rule: critical accounts — domain, website, donation platform — always carry at least two current administrators.

Donor Data: the Database of Trust

The donor and member list is the nonprofit's most sensitive asset, legally and reputationally: it falls under data-protection law, and the bill for a leak is trust lost before any fine — giving lives on trust. The minimum protection set fits a small budget: the list lives in a restricted environment, not an open spreadsheet; sensitive records such as aid applications are narrowed further; multi-factor authentication goes on across accounts; and bulk email runs on blind copy or the right tool — the "accidentally CC'd everyone" incident is the classic nonprofit accident.

The Budget Secret: Free Tiers for Nonprofits

The least-known nonprofit advantage is the free or deeply discounted enterprise programmes the big software providers reserve for associations and foundations: nonprofit tiers of the office-suite and corporate-email ecosystems, cloud storage, meeting tools, and nonprofit plans on several donation/CRM platforms. The application is a verification process run on founding documents, and the reward is enterprise infrastructure at near-zero cost. One practical warning: these accounts obey rule one too — they attach to the corporate roof, the inventory and the vault; otherwise the free tool becomes an unreachable account one term later.

Volunteer Devices and the Shared Computer

Nonprofit work often runs on volunteers' own machines and one shared computer at the office. Two practical rules make that safe: sensitive data such as the donor list is never downloaded to personal devices — it is worked on through restricted cloud access; and the shared computer runs individual sign-ins and stays updated. Donating retired computers is a fine nonprofit tradition — with the secure-wipe step included: a computer that leaves with the member list inside is a data leak distributed with good intentions.

The Public Face: Site, Social Media and the Donation Channel

Asset	Risk	Measure
Website	Unmaintained platform, an expired domain	Auto-renewal + current platform + backups
Social media	Account takeover — reputation and fake donation appeals	MFA + two admins + access in the vault
Online donations	Fake copies of the organisation's pages	One consistent official channel, announced everywhere; a reporting routine ready for clones
Email	Fake donation mail in the organisation's name	SPF/DKIM/DMARC records — free and effective

This table is the organisation's face to the public, and the attacker's target is usually not the till but the trust attached to the name — new-generation fraud deliberately turns toward nonprofit identities in campaign seasons.

Simple, Written, Transferable

The success measure of nonprofit IT is not sophistication but transferability: a one-page access inventory, passwords in the vault, a backup checked monthly, the list reviewed yearly. That order costs a three-hour setup and a few hours of upkeep per term — labour beyond comparison with the bill of a lost social account or a leaked member list.

Yamanlar Bilişim's Approach to Nonprofits

Working with associations and foundations, our priority is sustainability: the corporate account roof, the inventory-and-vault order, support with nonprofit programme applications and handover-ready documentation, built as one package. On the maintenance side, a light scope that protects the basics suits the nonprofit budget — the aim is volunteer energy flowing into the organisation's real work instead of wrestling technology.

FAQ