Not-for-Profit & Member Organisations
Not-for-profits carry the same privacy obligations as any other organisation holding personal information, usually without anyone whose job it is to meet them.
The defining constraint is that there is often no internal IT function at all — there is a person who is good with computers and a great deal of other work. Everything below has to work without a systems administrator watching it, because there is not one.
Donor and member data is the exposure. It is personal information under the Privacy Act, it is frequently the organisation’s most valuable asset, and it typically lives across a CRM, a mailbox, several spreadsheets and a volunteer’s laptop. A breach here costs the thing the organisation runs on, which is trust.
Budget shape matters as much as budget size. Grant funding rewards predictable operating cost and penalises unplanned capital spend, which favours managed services over owning infrastructure — provided the service is scoped to what is actually needed rather than to an enterprise template.
What we focus on in this sector
Scope is agreed per engagement. These are the areas that consistently carry the most value here.
Managed without an admin
An environment that stays patched, backed up and monitored without depending on somebody internal remembering to check it.
Volunteers on their own devices
A work boundary on personally owned devices that protects organisational data and can be removed cleanly, without claiming access to anything personal.
Donor data with a boundary
Access to member and donor records granted by role, logged, and removed when someone stops volunteering — not left in a shared login.
Recovery that has been tested
Backup of Microsoft 365 and business systems with a restore that has actually been performed, because retention policies are not backup.
Cost that fits a grant cycle
Predictable monthly operating cost, scoped to the organisation’s actual size rather than an enterprise baseline.
What changes once it is running properly
- An environment that does not depend on one person’s spare time
- Volunteer devices that can be offboarded in a minute
- Donor data with role-based access and an audit trail
- A restore you have watched work
What usually applies
A few of the organisations we have delivered for
Common questions
We are small. Is a managed service overkill?
It is the opposite — the smaller the internal team, the more of the environment depends on one person being available. The scope should match the organisation, and a small organisation should not be sold an enterprise baseline.
Volunteers use their own laptops and phones. What can we do?
Put a managed work boundary on the personal device. Organisational applications and data sit inside it and can be removed entirely when someone stops volunteering, while the personal side stays out of the organisation’s reach — and you can say that to volunteers truthfully.
Isn’t our Microsoft 365 data already backed up?
Not in the sense people mean. Microsoft protects the platform; retention policies and the recycle bin are not a backup, and they will not help against a deletion you only discover months later. That gap has an inexpensive answer, and it is worth closing before you need it.
Relevant to this sector
Retention is not backup — what Microsoft 365 does not protect
Microsoft protects the platform. Protecting your data in it is your responsibility, and the gap only becomes obvious at the worst possible moment.
BYOD, COPE or corporate-owned: choosing an ownership model
The ownership model decides your privacy position, your cost base and how much control you actually have. Most organisations pick it by accident.
Twelve questions to ask a managed service provider before you sign
Most MSP proposals look identical on paper. These are the questions that separate them — including the ones we would rather you did not ask us.
The pattern travels
Federal Government
Commonwealth agencies working to the PSPF and the Essential Eight, with mobile fleets that have to be defensible at audit.
ExploreDefence & National Security
Environments where devices go where connectivity does not, and where who touches the system matters as much as what it does.
ExploreParliamentary & Ministerial
High-profile users, high turnover at election cycles, and a very low tolerance for a device that does not just work.
ExploreTalk to us about Not-for-Profit & Member Organisations
Tell us what the environment looks like today. We will tell you honestly whether this is the right place to start.